Firefox · DOM
CVE-2026-4691
UAF in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/DocumentOrShadowRoot.cpp |
modified |
Files Changed
dom/base/DocumentOrShadowRoot.cpp
Patch
diff --git a/dom/base/DocumentOrShadowRoot.cpp b/dom/base/DocumentOrShadowRoot.cpp
index edf4b114444..71bfe7a1517 100644
--- a/dom/base/DocumentOrShadowRoot.cpp
+++ b/dom/base/DocumentOrShadowRoot.cpp
@@ -113,6 +113,10 @@ void DocumentOrShadowRoot::RemoveSheetFromStylesIfApplicable(
void DocumentOrShadowRoot::OnSetAdoptedStyleSheets(StyleSheet& aSheet,
uint32_t aIndex,
ErrorResult& aRv) {
+ if (aIndex > mAdoptedStyleSheets.Length()) [[unlikely]] {
+ MOZ_ASSERT_UNREACHABLE("Out of sync proxy");
+ return;
+ }
Document& doc = *AsNode().OwnerDoc();
// 1. If value’s constructed flag is not set, or its constructor document is
// not equal to this DocumentOrShadowRoot's node document, throw a
@@ -165,7 +169,10 @@ void DocumentOrShadowRoot::OnSetAdoptedStyleSheets(StyleSheet& aSheet,
void DocumentOrShadowRoot::OnDeleteAdoptedStyleSheets(StyleSheet& aSheet,
uint32_t aIndex,
ErrorResult&) {
- MOZ_ASSERT(mAdoptedStyleSheets.ElementAt(aIndex) == &aSheet);
+ if (mAdoptedStyleSheets.ElementAt(aIndex) != &aSheet) [[unlikely]] {
+ MOZ_ASSERT_UNREACHABLE("Out of sync proxy");
+ return;
+ }
mAdoptedStyleSheets.RemoveElementAt(aIndex);
auto existingIndex = mAdoptedStyleSheets.LastIndexOf(&aSheet);
if (existingIndex != mAdoptedStyleSheets.NoIndex && existingIndex >= aIndex) {
Loading diff…
References
On This Page