PresShell::GoToAnchor locates a target element for the fragment and then performs earlier work (captured in rv) that can run script, allowing content to mutate the DOM before the method continues to the aScroll handling. During that reentrancy the target element could be removed from mDocument (or relocated to another document), violating the invariant that target is still connected to the same presentation’s document when it is subsequently scrolled and state-marked. Because the code kept using the now-stale target pointer, it operated on an element whose backing storage may have been freed, producing a use-after-free.

The fix re-checks target->GetComposedDoc() != mDocument after the script-capable step and, if the target is no longer part of this document, clears the ElementState::URLTARGET state via esm->SetContentState(nullptr, ...) and returns NS_OK instead of touching the detached element. This restores the connected-to-mDocument invariant before any further use of target.

An attacker gains a use-after-free of a layout/DOM element in the content process that renders the malicious page, reachable purely through fragment or text-directive navigation. Exploitation can corrupt freed heap memory, potentially leading to a crash or memory-corruption primitive usable toward code execution within the content sandbox. The only precondition is inducing the victim to load attacker-controlled content that triggers GoToAnchor with reentrant script that detaches the target.