Firefox · DOM
CVE-2026-2798
UAF in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/Document.cpp |
modified |
Files Changed
dom/base/Document.cpp
Patch
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index ea8f76dc2f7..353cb3a20af 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -16225,17 +16225,16 @@ void Document::HidePopover(Element& aPopover, bool aFocusPreviousElement,
}
});
- PopoverData* popoverData = popoverHTMLEl->GetPopoverData();
-
// 7. If element's opened in popover mode is "auto" or "hint", then:
- if (popoverData &&
+ if (PopoverData* popoverData = popoverHTMLEl->GetPopoverData();
+ popoverData &&
popoverData->GetOpenedInMode() == PopoverAttributeState::Auto) {
- // 7.1. Run hide all popovers until given element, focusPreviousElement, and
- // fireEvents.
+ // 7.1. Run hide all popovers until given element, focusPreviousElement,
+ // and fireEvents.
HideAllPopoversUntil(*popoverHTMLEl, aFocusPreviousElement, fireEvents);
- // 7.2. If the result of running check popover validity given element, true,
- // and throwExceptions is false, then run cleanupSteps and return.
+ // 7.2. If the result of running check popover validity given element,
+ // true, and throwExceptions is false, then run cleanupSteps and return.
if (!popoverHTMLEl->CheckPopoverValidity(PopoverVisibilityState::Showing,
nullptr, aRv)) {
return;
@@ -16259,9 +16258,6 @@ void Document::HidePopover(Element& aPopover, bool aFocusPreviousElement,
}
}
- auto* data = popoverHTMLEl->GetPopoverData();
- MOZ_ASSERT(data, "Should have popover data");
-
// 9. If fireEvents is true:
// Fire beforetoggle event and re-check popover validity.
if (fireEvents) {
@@ -16292,7 +16288,9 @@ void Document::HidePopover(Element& aPopover, bool aFocusPreviousElement,
// 9.4. XXX: See below
// 9.5. Set element's implicit anchor element to null.
- data->SetInvoker(nullptr);
+ PopoverData* popoverData = popoverHTMLEl->GetPopoverData();
+ MOZ_ASSERT(popoverData, "Should have popover data");
+ popoverData->SetInvoker(nullptr);
}
// 9.4. Request an element to be removed from the top layer given element.
@@ -16300,16 +16298,17 @@ void Document::HidePopover(Element& aPopover, bool aFocusPreviousElement,
// element.
RemovePopoverFromTopLayer(aPopover);
- // 11. Set element's popover invoker to null.
- data->SetInvoker(nullptr);
+ if (PopoverData* popoverData = popoverHTMLEl->GetPopoverData()) {
+ // 11. Set element's popover invoker to null.
+ popoverData->SetInvoker(nullptr);
- // 12. Set element's opened in popover mode to null.
- popoverHTMLEl->GetPopoverData()->SetOpenedInMode(PopoverAttributeState::None);
+ // 12. Set element's opened in popover mode to null.
+ popoverData->SetOpenedInMode(PopoverAttributeState::None);
- // 13. Set element's popover visibility state to hidden.
- popoverHTMLEl->PopoverPseudoStateUpdate(false, true);
- popoverHTMLEl->GetPopoverData()->SetPopoverVisibilityState(
- PopoverVisibilityState::Hidden);
+ // 13. Set element's popover visibility state to hidden.
+ popoverHTMLEl->PopoverPseudoStateUpdate(false, true);
+ popoverData->SetPopoverVisibilityState(PopoverVisibilityState::Hidden);
+ }
// 14. If fireEvents is true, then queue a popover toggle event task given
// element, "open", and "closed". Queue popover toggle event task.
Loading diff…
References
On This Page