Firefox · DOM
CVE-2026-12315
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/nsTreeSanitizer.cpp |
modified |
Files Changed
dom/base/nsTreeSanitizer.cpp
Patch
diff --git a/dom/base/nsTreeSanitizer.cpp b/dom/base/nsTreeSanitizer.cpp
index 8ee5120bf6d..c13ff63b026 100644
--- a/dom/base/nsTreeSanitizer.cpp
+++ b/dom/base/nsTreeSanitizer.cpp
@@ -1450,6 +1450,11 @@ void nsTreeSanitizer::SanitizeChildren(nsINode* aRoot) {
NS_ASSERTION(ns == kNameSpaceID_XHTML || ns == kNameSpaceID_SVG ||
ns == kNameSpaceID_MathML,
"Should have only HTML, MathML or SVG here!");
+ if (elt->HasCustomElementData()) {
+ MOZ_ASSERT(elt->GetCustomElementData()->GetIs(elt),
+ "CustomElementData without an |is| attribute?");
+ elt->ClearCustomElementData();
+ }
AllowedAttributes allowed;
if (ns == kNameSpaceID_XHTML) {
allowed.mNames = sAttributesHTML;
Loading diff…
References
On This Page