Medium firefox UAF 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionUse-after-free in the Widget: Cocoa component
ComponentWidget
Bug ClassUAF
Tracker2017002
Fix commita3f546db9046 (firefox) +23/-14
CISA KEVNot listed
CreditedJosh Aas
Disclosed2026-03-24

Changed Functions

FunctionChangeNotes
if
widget/cocoa/nsMacSharingService.mm
modified

Files Changed

  • widget/cocoa/nsMacSharingService.mm
diff --git a/widget/cocoa/nsMacSharingService.mm b/widget/cocoa/nsMacSharingService.mm
index d07a79826f9..c2e432e2975 100644
--- a/widget/cocoa/nsMacSharingService.mm
+++ b/widget/cocoa/nsMacSharingService.mm
@@ -15,8 +15,10 @@
 
 NS_IMPL_ISUPPORTS(nsMacSharingService, nsIMacSharingService)
 
-NSString* const remindersServiceName =
+NSString* const oldRemindersServiceName =
     @"com.apple.reminders.RemindersShareExtension";
+NSString* const newRemindersServiceName =
+    @"com.apple.reminders.sharingextension";
 
 // These are some undocumented constants also used by Safari
 // to let us open the preferences window
@@ -67,12 +69,14 @@ static bool ShouldIgnoreProvider(NSString* aProviderName) {
 - (void)sharingService:(NSSharingService*)sharingService
          didShareItems:(NSArray*)items {
   [self cleanup];
+  [self release];
 }
 
 - (void)sharingService:(NSSharingService*)service
     didFailToShareItems:(NSArray*)items
                   error:(NSError*)error {
   [self cleanup];
+  [self release];
 }
 
 - (void)dealloc {
@@ -177,34 +181,39 @@ nsMacSharingService::ShareUrl(const nsAString& aServiceName,
   NS_OBJC_BEGIN_TRY_BLOCK_RETURN;
 
   NSString* serviceName = nsCocoaUtils::ToNSString(aServiceName);
-  NSURL* pageUrl = nsCocoaUtils::ToNSURL(aPageUrl);
-  NSString* pageTitle = nsCocoaUtils::ToNSString(aPageTitle);
   NSSharingService* service =
       [NSSharingService sharingServiceNamed:serviceName];
+  if (!service) {
+    return NS_ERROR_FAILURE;
+  }
+
+  NSString* pageTitle = nsCocoaUtils::ToNSString(aPageTitle);
+  [service setSubject:pageTitle];
 
-  // Reminders fetch its data from an activity, not the share data
-  if ([[service name] isEqual:remindersServiceName]) {
-    NSUserActivity* shareActivity = [[NSUserActivity alloc]
-        initWithActivityType:NSUserActivityTypeBrowsingWeb];
+  NSURL* pageUrl = nsCocoaUtils::ToNSURL(aPageUrl);
+  if (!pageUrl) {
+    return NS_ERROR_FAILURE;
+  }
+
+  // Reminders fetch data from an activity, not the share data
+  if ([serviceName isEqual:oldRemindersServiceName] ||
+      [serviceName isEqual:newRemindersServiceName]) {
+    NSUserActivity* shareActivity = [[[NSUserActivity alloc]
+        initWithActivityType:NSUserActivityTypeBrowsingWeb] autorelease];
 
     if ([pageUrl.scheme hasPrefix:@"http"]) {
       [shareActivity setWebpageURL:pageUrl];
     }
+
     [shareActivity setEligibleForHandoff:NO];
     [shareActivity setTitle:pageTitle];
     [shareActivity becomeCurrent];
 
-    // Pass ownership of shareActivity to shareDelegate, which will release the
-    // activity once sharing has completed.
     SharingServiceDelegate* shareDelegate =
         [[SharingServiceDelegate alloc] initWithActivity:shareActivity];
-    [shareActivity release];
-
-    [service setDelegate:shareDelegate];
-    [shareDelegate release];
+    [service setDelegate:shareDelegate];  // weak reference
   }
 
-  [service setSubject:pageTitle];
   [service performWithItems:@[ pageUrl ]];
 
   return NS_OK;
Loading diff…