Firefox · DOM
CVE-2026-12299
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/webidl/Document.webidldom/webidl/EditContext.webidldom/webidl/Element.webidldom/webidl/HTMLElement.webidldom/webidl/HTMLInputElement.webidl
Patch
diff --git a/dom/webidl/Document.webidl b/dom/webidl/Document.webidl
index 03284d1f13c..944864e0b28 100644
--- a/dom/webidl/Document.webidl
+++ b/dom/webidl/Document.webidl
@@ -669,7 +669,7 @@ partial interface Document {
* tracking, fingerprinting, cryptomining and so on. This method is for
* testing only.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
readonly attribute NodeList blockedNodesByClassifier;
};
diff --git a/dom/webidl/EditContext.webidl b/dom/webidl/EditContext.webidl
index 2f7df1c2c69..8d1c3808bde 100644
--- a/dom/webidl/EditContext.webidl
+++ b/dom/webidl/EditContext.webidl
@@ -25,7 +25,6 @@ interface EditContext : EventTarget {
undefined updateSelectionBounds(DOMRect selectionBounds);
undefined updateCharacterBounds(unsigned long rangeStart, sequence<DOMRect> characterBounds);
- [Pure]
sequence<HTMLElement> attachedElements();
[Pure]
@@ -36,7 +35,6 @@ interface EditContext : EventTarget {
readonly attribute unsigned long selectionEnd;
[Pure]
readonly attribute unsigned long characterBoundsRangeStart;
- [Pure]
sequence<DOMRect> characterBounds();
attribute EventHandler ontextupdate;
diff --git a/dom/webidl/Element.webidl b/dom/webidl/Element.webidl
index 90c4a004958..aceb70aeebb 100644
--- a/dom/webidl/Element.webidl
+++ b/dom/webidl/Element.webidl
@@ -39,7 +39,6 @@ interface Element : Node {
[SameObject]
readonly attribute NamedNodeMap attributes;
- [Pure]
sequence<DOMString> getAttributeNames();
[Pure]
DOMString? getAttribute(DOMString name);
@@ -365,7 +364,7 @@ partial interface Element {
* properties, as well as a property that exposes the flex lines
* in this container.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
Flex? getAsFlexContainer();
// Support reporting of Grid properties
@@ -374,13 +373,13 @@ partial interface Element {
* this property returns an object with computed values for grid
* tracks and lines.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
sequence<Grid> getGridFragments();
/**
* Returns whether there are any grid fragments on this element.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
boolean hasGridFragments();
/**
@@ -388,7 +387,7 @@ partial interface Element {
* that have display:grid or display:inline-grid style and generate
* a frame.
*/
- [ChromeOnly, Pure]
+ [ChromeOnly]
sequence<Element> getElementsWithGrid();
/**
diff --git a/dom/webidl/HTMLElement.webidl b/dom/webidl/HTMLElement.webidl
index 034aa0de194..e5d4fea347e 100644
--- a/dom/webidl/HTMLElement.webidl
+++ b/dom/webidl/HTMLElement.webidl
@@ -25,9 +25,9 @@ interface HTMLElement : Element {
[CEReactions, SetterThrows, Pure]
attribute DOMString dir;
- [CEReactions, GetterThrows, Pure]
+ [CEReactions, GetterThrows]
attribute [LegacyNullToEmptyString] DOMString innerText;
- [CEReactions, GetterThrows, SetterThrows, Pure]
+ [CEReactions, GetterThrows, SetterThrows]
attribute [LegacyNullToEmptyString] DOMString outerText;
// user interaction
diff --git a/dom/webidl/HTMLInputElement.webidl b/dom/webidl/HTMLInputElement.webidl
index be41ed49406..09964a99669 100644
--- a/dom/webidl/HTMLInputElement.webidl
+++ b/dom/webidl/HTMLInputElement.webidl
@@ -59,7 +59,7 @@ interface HTMLInputElement : HTMLElement {
attribute boolean formNoValidate;
[CEReactions, Pure, SetterThrows]
attribute DOMString formTarget;
- [CEReactions, Pure, SetterThrows]
+ [CEReactions, SetterThrows]
attribute unsigned long height;
[Pure]
attribute boolean indeterminate;
@@ -215,7 +215,7 @@ interface mixin MozEditableElement {
// Returns an nsIEditor instance which is associated with the element.
// If the element can be associated with an editor but not yet created,
// this creates new one automatically.
- [Pure, ChromeOnly, BinaryName="editorForBindings"]
+ [ChromeOnly, BinaryName="editorForBindings"]
readonly attribute nsIEditor? editor;
// Returns true if an nsIEditor instance has already been associated with
Loading diff…
References
On This Page