Firefox · Core
CVE-2026-16352
UAF in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifaccessible/ipc/DocAccessibleParent.cpp |
modified |
Files Changed
accessible/ipc/DocAccessibleParent.cpp
Patch
diff --git a/accessible/ipc/DocAccessibleParent.cpp b/accessible/ipc/DocAccessibleParent.cpp
index bb69e862469..41fba965cca 100644
--- a/accessible/ipc/DocAccessibleParent.cpp
+++ b/accessible/ipc/DocAccessibleParent.cpp
@@ -283,6 +283,11 @@ RemoteAccessible* DocAccessibleParent::CreateAcc(
"Attempt to move RemoteAccessible which still has a parent!");
return nullptr;
}
+ if (aAccData.ID() == mPendingShowChild) {
+ MOZ_ASSERT_UNREACHABLE(
+ "Attempt to move RemoteAccessible which has a pending parent");
+ return nullptr;
+ }
return newProxy;
}
@@ -422,6 +427,10 @@ mozilla::ipc::IPCResult DocAccessibleParent::ProcessHideEvent(
MOZ_ASSERT(CheckDocTree());
+ if (mPendingShowChild) {
+ return IPC_FAIL(this, "Hide during split show");
+ }
+
// We shouldn't actually need this because mAccessibles shouldn't have an
// entry for the document itself, but it doesn't hurt to be explicit.
if (!aRootID) {
Loading diff…
References
On This Page