Firefox · DOM
CVE-2026-2799
UAF in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/FragmentDirective.cpp |
modified |
Files Changed
dom/base/FragmentDirective.cppdom/base/TextDirectiveFinder.cpp
Patch
diff --git a/dom/base/FragmentDirective.cpp b/dom/base/FragmentDirective.cpp
index b834752146e..6972ae463b4 100644
--- a/dom/base/FragmentDirective.cpp
+++ b/dom/base/FragmentDirective.cpp
@@ -156,6 +156,11 @@ nsTArray<RefPtr<nsRange>> FragmentDirective::FindTextFragmentsInDocument() {
uri);
return {};
}
+ RefPtr doc = mDocument;
+ doc->FlushPendingNotifications(FlushType::Layout);
+ if (!mFinder) {
+ return {};
+ }
auto textDirectives = mFinder->FindTextDirectivesInDocument();
if (!mFinder->HasUninvokedDirectives()) {
mFinder = nullptr;
diff --git a/dom/base/TextDirectiveFinder.cpp b/dom/base/TextDirectiveFinder.cpp
index eca65975630..80515fb8b5c 100644
--- a/dom/base/TextDirectiveFinder.cpp
+++ b/dom/base/TextDirectiveFinder.cpp
@@ -55,7 +55,6 @@ nsTArray<RefPtr<nsRange>> TextDirectiveFinder::FindTextDirectivesInDocument() {
? mDocument->GetDocumentURI()->GetSpecOrDefault()
: nsCString();
TEXT_FRAGMENT_LOG("Trying to find text directives in document '{}'.", uri);
- mDocument->FlushPendingNotifications(FlushType::Layout);
// https://wicg.github.io/scroll-to-text-fragment/#invoke-text-directives
// To invoke text directives, given as input a list of text directives text
// directives and a Document document, run these steps:
Loading diff…
References
On This Page