PatchGap
Firefox · DOM

CVE-2026-5731

Memory Corruption in DOM
High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker2021894
Fix commit4f187245066f (firefox) +7/-0
CISA KEVNot listed
CreditedBrian Grinstead, Christian Holler, Tom Schuster and the Mozilla Fuzzing Team
Disclosed2026-04-07

Files Changed

  • dom/indexedDB/ActorsParent.cpp

Patch

view commit
diff --git a/dom/indexedDB/ActorsParent.cpp b/dom/indexedDB/ActorsParent.cpp
index cbf2c2e52ff..db84a850683 100644
--- a/dom/indexedDB/ActorsParent.cpp
+++ b/dom/indexedDB/ActorsParent.cpp
@@ -10403,6 +10403,13 @@ bool TransactionBase::VerifyRequestParams(
         if (NS_AUUF_OR_WARN_IF(!file)) {
           return false;
         }
+
+        // Reject actors managed by a different Database
+        if (NS_AUUF_OR_WARN_IF(file->Manager() !=
+                               static_cast<const PBackgroundIDBDatabaseParent*>(
+                                   &GetDatabase()))) {
+          return false;
+        }
         break;
 
       case StructuredCloneFileBase::eMutableFile: {
Loading diff…
On This Page