High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the JavaScript: GC component
ComponentCore
Bug ClassUAF
Tracker2009608
Fix commitf78480f4ede2 (firefox) +3/-3
CISA KEVNot listed
CreditedGary Kwong
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
mfbt/HashTable.h
modified

Files Changed

  • mfbt/HashTable.h
diff --git a/mfbt/HashTable.h b/mfbt/HashTable.h
index 67a5f25bf64..311b638d3af 100644
--- a/mfbt/HashTable.h
+++ b/mfbt/HashTable.h
@@ -1113,7 +1113,7 @@ class HashTableEntry {
 
   void destroy() { destroyStoredT(); }
 
-  void swap(HashTableEntry* aOther, bool aIsLive) {
+  void swap(HashTableEntry* aOther, bool aOtherIsLive) {
     // This allows types to use Argument-Dependent-Lookup, and thus use a custom
     // std::swap, which is needed by types like JS::Heap and such.
     using std::swap;
@@ -1121,10 +1121,10 @@ class HashTableEntry {
     if (this == aOther) {
       return;
     }
-    if (aIsLive) {
+    if (aOtherIsLive) {
       swap(*valuePtr(), *aOther->valuePtr());
     } else {
-      *aOther->valuePtr() = std::move(*valuePtr());
+      new (KnownNotNull, aOther->valuePtr()) NonConstT(std::move(*valuePtr()));
       destroy();
     }
   }
Loading diff…