High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassUAF
Tracker2014551
Fix commit08a5a0de9477 (firefox) +5/-1
CISA KEVNot listed
CreditedEvyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
dom/base/FragmentDirective.cpp
modified

Files Changed

  • dom/base/FragmentDirective.cpp
  • dom/base/TextDirectiveFinder.cpp
diff --git a/dom/base/FragmentDirective.cpp b/dom/base/FragmentDirective.cpp
index b834752146e..6972ae463b4 100644
--- a/dom/base/FragmentDirective.cpp
+++ b/dom/base/FragmentDirective.cpp
@@ -156,6 +156,11 @@ nsTArray<RefPtr<nsRange>> FragmentDirective::FindTextFragmentsInDocument() {
                       uri);
     return {};
   }
+  RefPtr doc = mDocument;
+  doc->FlushPendingNotifications(FlushType::Layout);
+  if (!mFinder) {
+    return {};
+  }
   auto textDirectives = mFinder->FindTextDirectivesInDocument();
   if (!mFinder->HasUninvokedDirectives()) {
     mFinder = nullptr;
diff --git a/dom/base/TextDirectiveFinder.cpp b/dom/base/TextDirectiveFinder.cpp
index eca65975630..80515fb8b5c 100644
--- a/dom/base/TextDirectiveFinder.cpp
+++ b/dom/base/TextDirectiveFinder.cpp
@@ -55,7 +55,6 @@ nsTArray<RefPtr<nsRange>> TextDirectiveFinder::FindTextDirectivesInDocument() {
                  ? mDocument->GetDocumentURI()->GetSpecOrDefault()
                  : nsCString();
   TEXT_FRAGMENT_LOG("Trying to find text directives in document '{}'.", uri);
-  mDocument->FlushPendingNotifications(FlushType::Layout);
   // https://wicg.github.io/scroll-to-text-fragment/#invoke-text-directives
   // To invoke text directives, given as input a list of text directives text
   // directives and a Document document, run these steps:
Loading diff…