Firefox · Core
CVE-2026-92016
Logic Error in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
accessible/base/NotificationController.cppaccessible/generic/DocAccessible.cpp
Patch
diff --git a/accessible/base/NotificationController.cpp b/accessible/base/NotificationController.cpp
index a583be8fdb9..497244733af 100644
--- a/accessible/base/NotificationController.cpp
+++ b/accessible/base/NotificationController.cpp
@@ -341,6 +341,7 @@ void NotificationController::DropMutationEvent(AccTreeMutationEvent* aEvent) {
MOZ_ASSERT(hideEvent);
if (hideEvent->NeedsShutdown()) {
+ mDocument->UncacheChildrenInSubtree(aEvent->GetAccessible());
mDocument->ShutdownChildrenInSubtree(aEvent->GetAccessible());
}
} else {
diff --git a/accessible/generic/DocAccessible.cpp b/accessible/generic/DocAccessible.cpp
index e6fae058244..abf274597c9 100644
--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -1358,6 +1358,9 @@ void DocAccessible::UnbindFromDocument(LocalAccessible* aAccessible) {
NS_ASSERTION(mAccessibleCache.GetWeak(aAccessible->UniqueID()),
"Unbinding the unbound accessible!");
+ MOZ_ASSERT(!mARIAOwnsHash.Contains(aAccessible),
+ "Container still lingering in mARIAOwnsHash");
+
// Fire focus event on accessible having DOM focus if last focus was removed
// from the tree.
if (FocusMgr()->WasLastFocused(aAccessible)) {
Loading diff…
References
On This Page