High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to use-after-free in the DOM: Navigation component
ComponentCore
Bug ClassUAF
Tracker2057817
Fix commit64a1e2a86345 (firefox) +11/-0
CISA KEVNot listed
CreditedYaqoub Aldurayhim
Disclosed2026-09-01

Changed Functions

FunctionChangeNotes
if
docshell/base/BrowsingContext.cpp
modified

Files Changed

  • docshell/base/BrowsingContext.cpp
diff --git a/docshell/base/BrowsingContext.cpp b/docshell/base/BrowsingContext.cpp
index e6d428105ee..6662d0e7200 100644
--- a/docshell/base/BrowsingContext.cpp
+++ b/docshell/base/BrowsingContext.cpp
@@ -916,6 +916,17 @@ const char* BrowsingContext::BrowsingContextCoherencyChecks(
         parent->mOriginAttributes.EqualsIgnoringFPD(mOriginAttributes));
   }
 
+  if (aOriginProcess) {
+    if (GetBrowserId() == 0) {
+      return "Content BC must have a nonzero BrowserId";
+    }
+    if (!GetParent()) {
+      uint64_t browserProc =
+          std::get<0>(nsContentUtils::SplitProcessSpecificId(GetBrowserId()));
+      COHERENCY_ASSERT(browserProc == aOriginProcess->ChildID());
+    }
+  }
+
   // UseRemoteSubframes and UseRemoteTabs must match.
   if (mUseRemoteSubframes && !mUseRemoteTabs) {
     return "Cannot set useRemoteSubframes without also setting useRemoteTabs";
Loading diff…