High firefox UAF 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentCore
Bug ClassUAF
Tracker2063871
Fix commitb99c8922aea8 (firefox) +2/-0
CISA KEVNot listed
CreditedYaqoub Aldurayhim
Disclosed2026-09-01

Files Changed

  • parser/html/nsHtml5TreeOperation.cpp
diff --git a/parser/html/nsHtml5TreeOperation.cpp b/parser/html/nsHtml5TreeOperation.cpp
index 0373b025624..ec5bedea211 100644
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -229,6 +229,8 @@ static void AbortNodeInsertion(nsINode* aNode) {
     // Clear form for this element, since it will not actually be
     // inserted.
     formControl->ClearForm(true, true);
+  } else if (auto* image = HTMLImageElement::FromNode(aNode)) {
+    image->ClearForm(true);
   }
 }
 
Loading diff…