PatchGap
Firefox · DOM

CVE-2026-8973

Memory Corruption in DOM
High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker1362365
Fix commit5f33bf94d058 (firefox) +450/-146
CISA KEVNot listed
CreditedAndrew Creskey, Andrew Osmond, Dana Keeler, Henri Sivonen, Jed Davis, John Schanck, Jon Coppeard, Justin Link, Michael Froman, Nika Layzell, Noah Lokocz, Randell Jesup, Steve Fink, Tom Schuster and the Mozilla Fuzzing Team
Disclosed2026-05-19

Changed Functions

FunctionChangeNotes
if
dom/html/nsHTMLDocument.cpp
 modified

Files Changed

  • .cargo/config.toml.in
  • Cargo.lock
  • Cargo.toml
  • docshell/test/browser/browser_bug1543077-3.js
  • docshell/test/browser/file_bug1543077-3.html
  • dom/html/nsHTMLDocument.cpp
  • extensions/universalchardet/tests/bug1362365_text.html
  • extensions/universalchardet/tests/chrome.toml
  • extensions/universalchardet/tests/test_bug1362365.html
  • intl/Encoding.h
  • intl/EncodingDetector.h
  • parser/html/nsHtml5StreamParser.cpp
  • supply-chain/config.toml
  • supply-chain/imports.lock
  • testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP-late.tentative.html
  • testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP.tentative.html
  • third_party/rust/chardetng/.cargo-checksum.json
  • third_party/rust/chardetng/.cargo_vcs_info.json
  • third_party/rust/chardetng/Cargo.lock
  • third_party/rust/chardetng/Cargo.toml
  • third_party/rust/chardetng/Cargo.toml.orig
  • third_party/rust/chardetng/README.md
  • third_party/rust/chardetng/src/lib.rs
  • third_party/rust/chardetng_c/.cargo-checksum.json
  • third_party/rust/chardetng_c/.cargo_vcs_info.json
  • third_party/rust/chardetng_c/Cargo.lock
  • third_party/rust/chardetng_c/Cargo.toml
  • third_party/rust/chardetng_c/Cargo.toml.orig
  • third_party/rust/chardetng_c/README.md
  • third_party/rust/chardetng_c/include/chardetng.h
  • third_party/rust/chardetng_c/src/lib.rs
  • toolkit/library/rust/shared/Cargo.toml

Patch

view commit
diff --git a/.cargo/config.toml.in b/.cargo/config.toml.in
index d3a0dd0ce46..7faf5402f72 100644
--- a/.cargo/config.toml.in
+++ b/.cargo/config.toml.in
@@ -55,16 +55,6 @@ git = "https://github.com/hsivonen/any_all_workaround"
 rev = "7fb1b7034c9f172aade21ee1c8554e8d8a48af80"
 replace-with = "vendored-sources"
 
-[source."git+https://github.com/hsivonen/chardetng?rev=a07d20273ce36146adaf76bd667dd57bd7b3508b"]
-git = "https://github.com/hsivonen/chardetng"
-rev = "a07d20273ce36146adaf76bd667dd57bd7b3508b"
-replace-with = "vendored-sources"
-
-[source."git+https://github.com/hsivonen/chardetng_c?rev=2f0aba284677d098de14f91ffe5a9e5b9a4922c2"]
-git = "https://github.com/hsivonen/chardetng_c"
-rev = "2f0aba284677d098de14f91ffe5a9e5b9a4922c2"
-replace-with = "vendored-sources"
-
 [source."git+https://github.com/hsivonen/rust-harfbuzz?rev=9d58a23a98772a197291d04af93f7041b7093d95"]
 git = "https://github.com/hsivonen/rust-harfbuzz"
 rev = "9d58a23a98772a197291d04af93f7041b7093d95"
diff --git a/Cargo.lock b/Cargo.lock
index d29d38df386..bdc40946758 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -852,8 +852,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chardetng"
-version = "0.1.17"
-source = "git+https://github.com/hsivonen/chardetng?rev=a07d20273ce36146adaf76bd667dd57bd7b3508b#a07d20273ce36146adaf76bd667dd57bd7b3508b"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13de944a44b5064ee5d3a5ceccc49a41bfec50f2580e66f82e87703acdb88b53"
 dependencies = [
  "cfg-if",
  "encoding_rs",
@@ -862,8 +863,9 @@ dependencies = [
 
 [[package]]
 name = "chardetng_c"
-version = "0.1.2"
-source = "git+https://github.com/hsivonen/chardetng_c?rev=2f0aba284677d098de14f91ffe5a9e5b9a4922c2#2f0aba284677d098de14f91ffe5a9e5b9a4922c2"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47a0270c68b4d2e2453bd31178f6a4470ef294f38872c7dd71ca3c591618be37"
 dependencies = [
  "chardetng",
  "encoding_rs",
diff --git a/Cargo.toml b/Cargo.toml
index b27bfd172f1..f9c59cb76ad 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -263,8 +263,6 @@ nss-gk-api = { git = "https://github.com/beurdouche/nss-gk-api", rev = "e48a9468
 
 # Other overrides
 any_all_workaround = { git = "https://github.com/hsivonen/any_all_workaround", rev = "7fb1b7034c9f172aade21ee1c8554e8d8a48af80" }
-chardetng = { git = "https://github.com/hsivonen/chardetng", rev = "a07d20273ce36146adaf76bd667dd57bd7b3508b" }
-chardetng_c = { git = "https://github.com/hsivonen/chardetng_c", rev = "2f0aba284677d098de14f91ffe5a9e5b9a4922c2" }
 cose = { git = "https://github.com/franziskuskiefer/cose-rust", rev = "43c22248d136c8b38fe42ea709d08da6355cf04b" }
 firefox-on-glean = { path = "toolkit/components/glean/api" }
 icu_capi = { path = "intl/icu_capi" }
diff --git a/docshell/test/browser/browser_bug1543077-3.js b/docshell/test/browser/browser_bug1543077-3.js
index 7cef4aef101..e266bfba058 100644
--- a/docshell/test/browser/browser_bug1543077-3.js
+++ b/docshell/test/browser/browser_bug1543077-3.js
@@ -10,27 +10,27 @@ function test() {
 function afterOpen() {
   is(
     content.document.documentElement.textContent.indexOf("\u3042"),
-    136,
+    147,
     "Parent doc should be ISO-2022-JP initially"
   );
 
   is(
     content.frames[0].document.documentElement.textContent.indexOf("\u3042"),
-    92,
-    "Child doc should be ISO-2022-JP initially"
+    -1,
+    "Child doc should be windows-1252 initially"
   );
 }
 
 function afterChangeCharset() {
   is(
     content.document.documentElement.textContent.indexOf("\u3042"),
-    136,
+    147,
     "Parent doc should decode as ISO-2022-JP subsequently"
   );
   is(
     content.frames[0].document.documentElement.textContent.indexOf("\u3042"),
-    92,
-    "Child doc should decode as ISO-2022-JP subsequently"
+    -1,
+    "Child doc should decode as windows-1252 subsequently"
   );
 
   is(
@@ -40,7 +40,7 @@ function afterChangeCharset() {
   );
   is(
     content.frames[0].document.characterSet,
-    "ISO-2022-JP",
-    "Child doc should report ISO-2022-JP subsequently"
+    "windows-1252",
+    "Child doc should report windows-1252 subsequently"
   );
 }
diff --git a/docshell/test/browser/file_bug1543077-3.html b/docshell/test/browser/file_bug1543077-3.html
index c4f467dd3fb..9dcf03727cb 100644
--- a/docshell/test/browser/file_bug1543077-3.html
+++ b/docshell/test/browser/file_bug1543077-3.html
@@ -1,11 +1,12 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
+<meta charset="ISO-2022-JP">
 <meta content="width=device-width, initial-scale=1" name="viewport">
-<title>No encoding declaration in parent or child</title>
+<title>Encoding declaration in parent but not in child</title>
 </head>
 <body>
-<h1>No encoding declaration in parent or child</h1>
+<h1>Encoding declaration in parent but not in child</h1>
 
 <p>Hiragana letter a if decoded as ISO-2022-JP: $B$"(B</p>
 
diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
index d2662fa3243..678494b7dfd 100644
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -90,10 +90,6 @@ using namespace mozilla::dom;
 // =
 // ==================================================================
 
-static bool IsAsciiCompatible(const Encoding* aEncoding) {
-  return aEncoding->IsAsciiCompatible() || aEncoding == ISO_2022_JP_ENCODING;
-}
-
 nsresult NS_NewHTMLDocument(Document** aInstancePtrResult,
                             nsIPrincipal* aPrincipal,
                             nsIPrincipal* aPartitionedPrincipal,
@@ -189,11 +185,11 @@ void nsHTMLDocument::TryReloadCharset(nsIDocumentViewer* aViewer,
       aViewer->ForgetReloadEncoding();
 
       if (reloadEncodingSource <= aCharsetSource ||
-          !IsAsciiCompatible(aEncoding)) {
+          !aEncoding->IsAsciiCompatible()) {
         return;
       }
 
-      if (reloadEncoding && IsAsciiCompatible(reloadEncoding)) {
+      if (reloadEncoding && reloadEncoding->IsAsciiCompatible()) {
         aCharsetSource = reloadEncodingSource;
         aEncoding = WrapNotNull(reloadEncoding);
       }
@@ -217,7 +213,7 @@ void nsHTMLDocument::TryUserForcedCharset(nsIDocumentViewer* aViewer,
   }
 
   // mCharacterSet not updated yet for channel, so check aEncoding, too.
-  if (WillIgnoreCharsetOverride() || !IsAsciiCompatible(aEncoding)) {
+  if (WillIgnoreCharsetOverride() || !aEncoding->IsAsciiCompatible()) {
     return;
   }
 
@@ -249,8 +245,8 @@ void nsHTMLDocument::TryParentCharset(nsIDocShell* aDocShell,
   if (kCharsetFromInitialUserForcedAutoDetection == parentSource ||
       kCharsetFromFinalUserForcedAutoDetection == parentSource) {
     if (WillIgnoreCharsetOverride() ||
-        !IsAsciiCompatible(aEncoding) ||  // if channel said UTF-16
-        !IsAsciiCompatible(parentCharset)) {
+        !aEncoding->IsAsciiCompatible() ||  // if channel said UTF-16
+        !parentCharset->IsAsciiCompatible()) {
       return;
     }
     aEncoding = WrapNotNull(parentCharset);
@@ -266,7 +262,7 @@ void nsHTMLDocument::TryParentCharset(nsIDocShell* aDocShell,
   if (kCharsetFromInitialAutoDetectionASCII <= parentSource) {
     // Make sure that's OK
     if (!NodePrincipal()->Equals(parentPrincipal) ||
-        !IsAsciiCompatible(parentCharset)) {
+        !parentCharset->IsAsciiCompatible()) {
       return;
     }
 
@@ -759,8 +755,7 @@ bool nsHTMLDocument::WillIgnoreCharsetOverride() {
   if (mCharacterSetSource >= kCharsetFromByteOrderMark) {
     return true;
   }
-  if (!mCharacterSet->IsAsciiCompatible() &&
-      mCharacterSet != ISO_2022_JP_ENCODING) {
+  if (!mCharacterSet->IsAsciiCompatible()) {
     return true;
   }
   nsIURI* uri = GetOriginalURI();
diff --git a/extensions/universalchardet/tests/bug1362365_text.html b/extensions/universalchardet/tests/bug1362365_text.html
new file mode 100644
index 00000000000..c666c46dcc4
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/docshell/test/browser/browser_bug1543077-3.js b/docshell/test/browser/browser_bug1543077-3.js
index 7cef4aef101..e266bfba058 100644
--- a/docshell/test/browser/browser_bug1543077-3.js
+++ b/docshell/test/browser/browser_bug1543077-3.js
@@ -10,27 +10,27 @@ function test() {
 function afterOpen() {
   is(
     content.document.documentElement.textContent.indexOf("\u3042"),
-    136,
+    147,
     "Parent doc should be ISO-2022-JP initially"
   );
 
   is(
     content.frames[0].document.documentElement.textContent.indexOf("\u3042"),
-    92,
-    "Child doc should be ISO-2022-JP initially"
+    -1,
+    "Child doc should be windows-1252 initially"
   );
 }
 
 function afterChangeCharset() {
   is(
     content.document.documentElement.textContent.indexOf("\u3042"),
-    136,
+    147,
     "Parent doc should decode as ISO-2022-JP subsequently"
   );
   is(
     content.frames[0].document.documentElement.textContent.indexOf("\u3042"),
-    92,
-    "Child doc should decode as ISO-2022-JP subsequently"
+    -1,
+    "Child doc should decode as windows-1252 subsequently"
   );
 
   is(
@@ -40,7 +40,7 @@ function afterChangeCharset() {
   );
   is(
     content.frames[0].document.characterSet,
-    "ISO-2022-JP",
-    "Child doc should report ISO-2022-JP subsequently"
+    "windows-1252",
+    "Child doc should report windows-1252 subsequently"
   );
 }
diff --git a/docshell/test/browser/file_bug1543077-3.html b/docshell/test/browser/file_bug1543077-3.html
index c4f467dd3fb..9dcf03727cb 100644
--- a/docshell/test/browser/file_bug1543077-3.html
+++ b/docshell/test/browser/file_bug1543077-3.html
@@ -1,11 +1,12 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
+<meta charset="ISO-2022-JP">
 <meta content="width=device-width, initial-scale=1" name="viewport">
-<title>No encoding declaration in parent or child</title>
+<title>Encoding declaration in parent but not in child</title>
 </head>
 <body>
-<h1>No encoding declaration in parent or child</h1>
+<h1>Encoding declaration in parent but not in child</h1>
 
 <p>Hiragana letter a if decoded as ISO-2022-JP: $B$"(B</p>
diff --git a/extensions/universalchardet/tests/bug1362365_text.html b/extensions/universalchardet/tests/bug1362365_text.html
new file mode 100644
index 00000000000..c666c46dcc4
--- /dev/null
+++ b/extensions/universalchardet/tests/bug1362365_text.html
@@ -0,0 +1 @@
+<title>$BF|K\8l(B</title>
diff --git a/extensions/universalchardet/tests/chrome.toml b/extensions/universalchardet/tests/chrome.toml
index 767be95fda2..190033d792c 100644
--- a/extensions/universalchardet/tests/chrome.toml
+++ b/extensions/universalchardet/tests/chrome.toml
@@ -23,6 +23,7 @@ support-files = [
   "bug1071816-2_text.html",
   "bug1071816-3_text.html",
   "bug1071816-4_text.html",
+  "bug1362365_text.html",
 ]
 
 ["test_bug306272.html"]
@@ -70,3 +71,5 @@ support-files = [
 ["test_bug1071816-3.html"]
 
 ["test_bug1071816-4.html"]
+
+["test_bug1362365.html"]
diff --git a/extensions/universalchardet/tests/test_bug1362365.html b/extensions/universalchardet/tests/test_bug1362365.html
new file mode 100644
index 00000000000..8c7a858761a
--- /dev/null
+++ b/extensions/universalchardet/tests/test_bug1362365.html
@@ -0,0 +1,30 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1362365
+-->
+<head>
+  <title>Test for Bug 1362365</title>
+  <script type="text/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js">
+          </script>
+  <script type="text/javascript" src="CharsetDetectionTests.js"></script>
+  <link rel="stylesheet" type="text/css"
+        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1362365">Mozilla Bug 1362365</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<iframe id="testframe"></iframe>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+/** Test for Bug 1362365 */
+CharsetDetectionTests("bug1362365_text.html",
+                      "UTF-8", // not windows-1252 due this counting as explicit override
+                      new Array("ja_parallel_state_machine"));
+</script>
+</pre>
+</body>
+</html>
diff --git a/testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP-late.tentative.html b/testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP-late.tentative.html
index 6e4bc9157d8..2d780a55c02 100644
--- a/testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP-late.tentative.html
+++ b/testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP-late.tentative.html
@@ -7,7 +7,7 @@
 setup({explicit_done:true});
 window.onmessage = function(e) {
     test(function() {
-        assert_equals(e.data, "ISO-2022-JP", 'Expected ISO-2022-JP');
+        assert_equals(e.data, "windows-1252", 'Expected windows-1252 due to ISO-2022-JP no longer getting detected');
     }, "Check detection result");
     w.close();
     done();
diff --git a/testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP.tentative.html b/testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP.tentative.html
index 405e123808d..e67adfd45e7 100644
--- a/testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP.tentative.html
+++ b/testing/web-platform/tests/encoding-detection/ja-ISO-2022-JP.tentative.html
@@ -7,7 +7,7 @@
 setup({explicit_done:true});
 onload = function() {
     test(function() {
-        assert_equals(document.characterSet, "ISO-2022-JP", 'Expected ISO-2022-JP');
+        assert_equals(document.characterSet, "windows-1252", 'Expected windows-1252 due to ISO-2022-JP no longer getting detected');
     }, "Check detection result");
       done();
 };
Loading diff…
On This Page