High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Networking component
ComponentDOM
Bug ClassUAF
Tracker2034352
Fix commitcbd8affa6f1c (firefox) +3/-3
CISA KEVNot listed
CreditedKevin Brosnan
Disclosed2026-05-07

Files Changed

  • dom/url/URL.cpp
  • dom/url/URL.h
diff --git a/dom/url/URL.cpp b/dom/url/URL.cpp
index b60a03e9656..77adb08f05c 100644
--- a/dom/url/URL.cpp
+++ b/dom/url/URL.cpp
@@ -146,9 +146,9 @@ bool URL::CanParse(const GlobalObject& aGlobal, const nsACString& aURL,
   return !!uri;
 }
 
-URLSearchParams* URL::SearchParams() {
+already_AddRefed<URLSearchParams> URL::SearchParams() {
   CreateSearchParamsIfNeeded();
-  return mSearchParams;
+  return do_AddRef(mSearchParams);
 }
 
 void URL::CreateSearchParamsIfNeeded() {
diff --git a/dom/url/URL.h b/dom/url/URL.h
index adea3686e91..c33ef3eb61b 100644
--- a/dom/url/URL.h
+++ b/dom/url/URL.h
@@ -102,7 +102,7 @@ class URL final : public URLSearchParamsObserver, public nsWrapperCache {
   void GetSearch(nsACString& aSearch) const;
   void SetSearch(const nsACString& aSearch);
 
-  URLSearchParams* SearchParams();
+  already_AddRefed<URLSearchParams> SearchParams();
 
   void GetHash(nsACString& aHash) const;
   void SetHash(const nsACString& aHash);
Loading diff…