High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to use-after-free in the Disability Access APIs component
ComponentCore
Bug ClassUAF
Tracker2046416
Fix commit08c0166d1889 (firefox) +9/-0
CISA KEVNot listed
CreditedOskar L
Disclosed2026-07-21

Changed Functions

FunctionChangeNotes
if
accessible/ipc/DocAccessibleParent.cpp
modified

Files Changed

  • accessible/ipc/DocAccessibleParent.cpp
diff --git a/accessible/ipc/DocAccessibleParent.cpp b/accessible/ipc/DocAccessibleParent.cpp
index bb69e862469..41fba965cca 100644
--- a/accessible/ipc/DocAccessibleParent.cpp
+++ b/accessible/ipc/DocAccessibleParent.cpp
@@ -283,6 +283,11 @@ RemoteAccessible* DocAccessibleParent::CreateAcc(
           "Attempt to move RemoteAccessible which still has a parent!");
       return nullptr;
     }
+    if (aAccData.ID() == mPendingShowChild) {
+      MOZ_ASSERT_UNREACHABLE(
+          "Attempt to move RemoteAccessible which has a pending parent");
+      return nullptr;
+    }
     return newProxy;
   }
 
@@ -422,6 +427,10 @@ mozilla::ipc::IPCResult DocAccessibleParent::ProcessHideEvent(
 
   MOZ_ASSERT(CheckDocTree());
 
+  if (mPendingShowChild) {
+    return IPC_FAIL(this, "Hide during split show");
+  }
+
   // We shouldn't actually need this because mAccessibles shouldn't have an
   // entry for the document itself, but it doesn't hurt to be explicit.
   if (!aRootID) {
Loading diff…