High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentLayout
Bug ClassUAF
Tracker2057778
Fix commit17062a84ca5d (firefox) +5/-0
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
if
layout/base/PresShell.cpp
modified

Files Changed

  • layout/base/PresShell.cpp
diff --git a/layout/base/PresShell.cpp b/layout/base/PresShell.cpp
index 71157fae90e..ec1e4881193 100644
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -3210,6 +3210,11 @@ nsresult PresShell::GoToAnchor(const nsAString& aAnchorName,
       return rv.StealNSResult();
     }
 
+    if (MOZ_UNLIKELY(target->GetComposedDoc() != mDocument)) {
+      esm->SetContentState(nullptr, ElementState::URLTARGET);
+      return NS_OK;
+    }
+
     if (aScroll) {
       // https://wicg.github.io/scroll-to-text-fragment/#invoking-text-directives
       // From "Monkeypatching HTML § 7.4.6.3 Scrolling to a fragment:"
Loading diff…