PatchGap
Firefox · SpiderMonkey

CVE-2026-15718

Logic Error in SpiderMonkey
Critical firefox Logic Error 🔧 Commit mapped

Overview

Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactcritical
DescriptionWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.
ComponentSpiderMonkey
Bug ClassLogic Error
Tracker2045443
Fix commit4441102e62e8 (firefox) +2/-0
CISA KEVNot listed
CreditedChristian Holler
Disclosed2026-07-14

Files Changed

  • js/src/wasm/WasmBaselineCompile.cpp

Patch

view commit
diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
index 6f6fbd72eba..6d94c781ebf 100644
--- a/js/src/wasm/WasmBaselineCompile.cpp
+++ b/js/src/wasm/WasmBaselineCompile.cpp
@@ -8976,6 +8976,8 @@ bool BaseCompiler::emitArrayFill() {
     freePtr(RegPtr(PreBarrierReg));
   }
 
+  sync();
+
   // Perform the fill loop using `numElements` as the loop variable, counting
   // down to zero.
   Label done;
Loading diff…
On This Page