Firefox · Layout
CVE-2026-84121
UAF in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
image/decoders/icon/components.conflayout/build/components.confmodules/libjar/components.confnetwerk/build/components.confsecurity/manager/ssl/components.confxpcom/components/StaticComponents.hxpcom/components/gen_static_components.pyxpcom/io/moz.buildxpcom/io/nsBinaryStream.cpp
Patch
diff --git a/image/decoders/icon/components.conf b/image/decoders/icon/components.conf
index 9bac3483e60..ecfd64a09f6 100644
--- a/image/decoders/icon/components.conf
+++ b/image/decoders/icon/components.conf
@@ -23,5 +23,6 @@ Classes = [
'cid': '{1460df3b-774c-4205-8349-838e507c3ef9}',
'type': 'nsMozIconURI::Mutator',
'headers': ['/image/decoders/icon/nsIconURI.h'],
+ 'serializable': True,
},
]
diff --git a/layout/build/components.conf b/layout/build/components.conf
index de302238380..791222eb1e9 100644
--- a/layout/build/components.conf
+++ b/layout/build/components.conf
@@ -52,11 +52,13 @@ Classes = [
'cid': '{574ce83e-fe9f-4095-b85c-7909abbf7c37}',
'type': 'nsJSURI::Mutator',
'headers': ['nsJSProtocolHandler.h'],
+ 'serializable': True,
},
{
'cid': '{58f089ee-512a-42d2-a935-d0c874128930}',
'type': 'nsJSURI::Mutator',
'headers': ['nsJSProtocolHandler.h'],
+ 'serializable': True,
},
{
'cid': '{48118355-e9a5-4452-ab18-59cc426fb817}',
@@ -71,11 +73,13 @@ Classes = [
'cid': '{bbe50ef2-80eb-469d-b70d-02858275389f}',
'type': 'mozilla::dom::BlobURL::Mutator',
'headers': ['mozilla/dom/BlobURL.h'],
+ 'serializable': True,
},
{
'cid': '{f5475c51-59a7-4757-b3d9-e211a9410872}',
'type': 'mozilla::dom::BlobURL::Mutator',
'headers': ['mozilla/dom/BlobURL.h'],
+ 'serializable': True,
},
{
'js_name': 'cpmm',
@@ -113,6 +117,7 @@ Classes = [
'contract_ids': ['@mozilla.org/cspcontext;1'],
'type': 'nsCSPContext',
'headers': ['mozilla/dom/nsCSPContext.h'],
+ 'serializable': True,
},
{
'cid': '{8d2f40b2-4875-4c95-97d9-3f7dca2cb460}',
@@ -126,6 +131,7 @@ Classes = [
'contract_ids': ['@mozilla.org/integritypolicy;1'],
'type': 'mozilla::dom::IntegrityPolicy',
'headers': ['mozilla/dom/IntegrityPolicy.h'],
+ 'serializable': True,
},
{
'cid': '{3662958c-0e34-4f57-bc6d-2accdeb4342e}',
@@ -139,6 +145,7 @@ Classes = [
'contract_ids': ['@mozilla.org/policycontainer;1'],
'type': 'PolicyContainer',
'headers': ['mozilla/dom/PolicyContainer.h'],
+ 'serializable': True,
},
{
'cid': '{1147d32c-215b-4014-b180-07fe7aedf915}',
@@ -208,6 +215,7 @@ Classes = [
'contract_ids': [],
'type': 'ExpandedPrincipal::Deserializer',
'headers': ['/caps/ExpandedPrincipal.h'],
+ 'serializable': True,
},
{
'js_name': 'focus',
@@ -305,6 +313,7 @@ Classes = [
'contract_ids': ['@mozilla.org/referrer-info;1'],
'type': 'mozilla::dom::ReferrerInfo',
'headers': ['mozilla/dom/ReferrerInfo.h'],
+ 'serializable': True,
},
{
'cid': '{bfc310d2-38a0-11d3-8cd3-0060b0fc14a3}',
@@ -335,6 +344,7 @@ Classes = [
'contract_ids': [],
'type': 'mozilla::NullPrincipal::Deserializer',
'headers': ['/caps/NullPrincipal.h'],
+ 'serializable': True,
},
{
'js_name': 'ppmm',
@@ -353,6 +363,7 @@ Classes = [
'contract_ids': [],
'type': 'mozilla::ContentPrincipal::Deserializer',
'headers': ['/caps/ContentPrincipal.h'],
+ 'serializable': True,
},
{
'cid': '{f68037ec-2790-44c5-8e5f-df5da58b93a7}',
@@ -399,6 +410,7 @@ Classes = [
'type': 'nsIPrincipal',
'headers': ['nsScriptSecurityManager.h', '/caps/SystemPrincipal.h'],
'constructor': 'nsScriptSecurityManager::SystemPrincipalSingletonConstructor',
+ 'serializable': True,
},
{
'cid': '{caaab47f-1e31-478e-8919-970904e9cb72}',
diff --git a/modules/libjar/components.conf b/modules/libjar/components.conf
index a2f231f235a..38f8638c346 100644
--- a/modules/libjar/components.conf
+++ b/modules/libjar/components.conf
@@ -32,11 +32,13 @@ Classes = [
'cid': '{245abae2-b947-4ded-a46d-9829d3cca462}',
'type': 'nsJARURI::Mutator',
'headers': ['nsJARURI.h'],
+ 'serializable': True,
},
{
'cid': '{19d9161b-a2a9-4518-b2c9-fcb8296d6dcd}',
'type': 'nsJARURI::Mutator',
'headers': ['nsJARURI.h'],
+ 'serializable': True,
},
{
'cid': '{608b7f6f-4b60-40d6-87ed-d933bf53d8c1}',
diff --git a/netwerk/build/components.conf b/netwerk/build/components.conf
index f0a998f6da3..660fbb2eaad 100644
--- a/netwerk/build/components.conf
+++ b/netwerk/build/components.conf
@@ -604,6 +604,7 @@ Classes = [
'type': 'mozilla::net::nsSimpleURI::Mutator',
'headers': ['nsSimpleURI.h'],
'processes': ProcessSelector.ALLOW_IN_SOCKET_PROCESS,
+ 'serializable': True,
},
{
'cid': '{04445aa0-fd27-4c99-bd41-6be6318ae92c}',
@@ -611,6 +612,7 @@ Classes = [
'type': 'mozilla::net::DefaultURI::Mutator',
'headers': ['/netwerk/base/DefaultURI.h'],
'processes': ProcessSelector.ALLOW_IN_SOCKET_PROCESS,
+ 'serializable': True,
},
{
'name': 'SocketTransport',
@@ -628,6 +630,7 @@ Classes = [
'type': 'mozilla::net::nsStandardURL::Mutator',
'headers': ['/netwerk/base/nsStandardURL.h'],
'processes': ProcessSelector.ALLOW_IN_SOCKET_PROCESS,
+ 'serializable': True,
},
{
'cid': '{831f8f13-7aa8-485f-b02e-77c881cc5773}',
@@ -743,30 +746,35 @@ Classes = [
'contract_ids': [],
'type': 'mozilla::net::nsNestedAboutURI::Mutator',
'headers': ['/netwerk/protocol/about/nsAboutProtocolHandler.h'],
+ 'serializable': True,
},
{
'cid': '{56388dad-287b-4240-a785-85c394012503}',
'contract_ids': [],
'type': 'mozilla::net::nsSimpleNestedURI::Mutator',
'headers': ['nsSimpleNestedURI.h'],
+ 'serializable': True,
},
{
'cid': '{9c4e9d49-ce64-4ca3-acef-3075c5e5aba7}',
'contract_ids': [],
'type': 'mozilla::net::nsSimpleNestedURI::Mutator',
'headers': ['nsSimpleNestedURI.h'],
+ 'serializable': True,
},
{
'cid': '{b0054ef3-b096-483d-8242-4ee36b7b2115}',
'contract_ids': [],
'type': 'mozilla::net::nsNestedAboutURI::Mutator',
'headers': ['/netwerk/protocol/about/nsAboutProtocolHandler.h'],
+ 'serializable': True,
},
{
'cid': '{b3cfeb91-332a-46c9-ad97-93ff39841494}',
'contract_ids': [],
'type': 'mozilla::net::SubstitutingURL::Mutator',
'headers': ['mozilla/net/SubstitutingURL.h'],
+ 'serializable': True,
},
{
'cid': '{de9472d0-8034-11d3-9399-00104ba0fd40}',
@@ -774,12 +782,14 @@ Classes = [
'type': 'mozilla::net::nsStandardURL::Mutator',
'headers': ['/netwerk/base/nsStandardURL.h'],
'processes': ProcessSelector.ALLOW_IN_SOCKET_PROCESS,
+ 'serializable': True,
},
{
'cid': '{dea9657c-18cf-4984-bde9-ccef5d8ab473}',
'contract_ids': [],
'type': 'mozilla::net::SubstitutingURL::Mutator',
'headers': ['mozilla/net/SubstitutingURL.h'],
Loading diff…
References
On This Page