PatchGap
Firefox · DOM

CVE-2026-8965

Logic Error in DOM
Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionInformation disclosure in the DOM: Security component
ComponentDOM
Bug ClassLogic Error
Tracker2025740
Fix commitad00cac75e5a (firefox) +5/-1
CISA KEVNot listed
CreditedShihab Mirza
Disclosed2026-05-19

Files Changed

  • dom/base/nsTreeSanitizer.cpp
  • parser/xml/test/unit/test_sanitizer_style.js

Patch

view commit
diff --git a/dom/base/nsTreeSanitizer.cpp b/dom/base/nsTreeSanitizer.cpp
index fa5cdbbdaca..2ab5d488c9e 100644
--- a/dom/base/nsTreeSanitizer.cpp
+++ b/dom/base/nsTreeSanitizer.cpp
@@ -1143,7 +1143,7 @@ bool nsTreeSanitizer::SanitizeInlineStyle(
 
   nsAutoString sanitizedStyle;
   SanitizeStyleSheet(styleText, sanitizedStyle, aElement->OwnerDoc(),
-                     aElement->GetBaseURI(), StyleSanitizationKind::Standard);
+                     aElement->GetBaseURI(), aSanitizationKind);
   RemoveAllAttributesFromDescendants(aElement);
   nsContentUtils::SetNodeTextContent(aElement, sanitizedStyle, true);
 
diff --git a/parser/xml/test/unit/test_sanitizer_style.js b/parser/xml/test/unit/test_sanitizer_style.js
index 55689380edc..ddcd8b0b6e7 100644
--- a/parser/xml/test/unit/test_sanitizer_style.js
+++ b/parser/xml/test/unit/test_sanitizer_style.js
@@ -80,6 +80,10 @@ const kConditionalCSSTestCases = [
     data: `@media (min-width: 300px) { #bar { display: none } }`,
     sanitized: ``,
   },
+  {
+    data: `@keyframes foo { to { opacity: 0 } }`,
+    sanitized: `@keyframes foo { to { opacity: 0 } }`,
+  },
 ];
 
 function run_test() {
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/parser/xml/test/unit/test_sanitizer_style.js b/parser/xml/test/unit/test_sanitizer_style.js
index 55689380edc..ddcd8b0b6e7 100644
--- a/parser/xml/test/unit/test_sanitizer_style.js
+++ b/parser/xml/test/unit/test_sanitizer_style.js
@@ -80,6 +80,10 @@ const kConditionalCSSTestCases = [
     data: `@media (min-width: 300px) { #bar { display: none } }`,
     sanitized: ``,
   },
+  {
+    data: `@keyframes foo { to { opacity: 0 } }`,
+    sanitized: `@keyframes foo { to { opacity: 0 } }`,
+  },
 ];
 
 function run_test() {
Loading diff…
On This Page