High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the Layout: Text and Fonts component
ComponentLayout
Bug ClassUAF
Tracker2020190
Fix commit13979138a703 (firefox) +6/-0
CISA KEVNot listed
CreditedSota Wada
Disclosed2026-03-24

Files Changed

  • layout/style/FontFace.cpp
diff --git a/layout/style/FontFace.cpp b/layout/style/FontFace.cpp
index ec69197ff11..7fc9362e81c 100644
--- a/layout/style/FontFace.cpp
+++ b/layout/style/FontFace.cpp
@@ -279,6 +279,12 @@ void FontFace::MaybeResolve() {
     return;
   }
 
+  if (!nsContentUtils::IsSafeToRunScript()) {
+    nsContentUtils::AddScriptRunner(NewRunnableMethod(
+        "FontFace::MaybeResolve", this, &FontFace::MaybeResolve));
+    return;
+  }
+
   mLoaded->MaybeResolve(this);
 }
 
Loading diff…