Firefox · DOM
CVE-2026-92023
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/xml/nsXMLContentSink.cpp |
modified |
Files Changed
dom/xml/nsXMLContentSink.cpp
Patch
diff --git a/dom/xml/nsXMLContentSink.cpp b/dom/xml/nsXMLContentSink.cpp
index c34d6957e93..39a68c7f17a 100644
--- a/dom/xml/nsXMLContentSink.cpp
+++ b/dom/xml/nsXMLContentSink.cpp
@@ -953,6 +953,9 @@ bool nsXMLContentSink::SetDocElement(int32_t aNameSpaceID, nsAtom* aTagName,
}
if (MOZ_UNLIKELY(child->GetParentNode())) {
child->Remove();
+ if (MOZ_UNLIKELY(child->GetParentNode())) {
+ return false;
+ }
}
mDocument->AppendChildTo(child, false, IgnoreErrors());
if (linkStyle) {
@@ -1069,6 +1072,9 @@ nsresult nsXMLContentSink::HandleStartElement(
if (MOZ_UNLIKELY(content->GetParentNode())) {
content->Remove();
+ if (MOZ_UNLIKELY(content->GetParentNode())) {
+ return NS_ERROR_UNEXPECTED;
+ }
}
parent->AppendChildTo(content, false, IgnoreErrors());
}
Loading diff…
References
On This Page