High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUndefined behavior in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2014593
Fix commit2ce8538f27de (firefox) +4/-1
CISA KEVNot listed
CreditedEvyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
Disclosed2026-02-24

Files Changed

  • dom/base/Document.cpp
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index 39352a3d48f..39c797affe5 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -693,7 +693,10 @@ class SimpleHTMLCollection final : public nsSimpleContentList,
   }
   virtual uint32_t Length() override { return nsSimpleContentList::Length(); }
   virtual Element* GetElementAt(uint32_t aIndex) override {
-    return mElements.SafeElementAt(aIndex)->AsElement();
+    if (nsIContent* content = mElements.SafeElementAt(aIndex)) {
+      return content->AsElement();
+    }
+    return nullptr;
   }
 
   virtual Element* GetFirstNamedElement(const nsAString& aName,
Loading diff…