High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the XML component
ComponentDOM
Bug ClassLogic Error
Tracker2068342
Fix commit0efbf2875092 (firefox) +6/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
if
dom/xml/nsXMLContentSink.cpp
modified

Files Changed

  • dom/xml/nsXMLContentSink.cpp
diff --git a/dom/xml/nsXMLContentSink.cpp b/dom/xml/nsXMLContentSink.cpp
index c34d6957e93..39a68c7f17a 100644
--- a/dom/xml/nsXMLContentSink.cpp
+++ b/dom/xml/nsXMLContentSink.cpp
@@ -953,6 +953,9 @@ bool nsXMLContentSink::SetDocElement(int32_t aNameSpaceID, nsAtom* aTagName,
     }
     if (MOZ_UNLIKELY(child->GetParentNode())) {
       child->Remove();
+      if (MOZ_UNLIKELY(child->GetParentNode())) {
+        return false;
+      }
     }
     mDocument->AppendChildTo(child, false, IgnoreErrors());
     if (linkStyle) {
@@ -1069,6 +1072,9 @@ nsresult nsXMLContentSink::HandleStartElement(
 
       if (MOZ_UNLIKELY(content->GetParentNode())) {
         content->Remove();
+        if (MOZ_UNLIKELY(content->GetParentNode())) {
+          return NS_ERROR_UNEXPECTED;
+        }
       }
       parent->AppendChildTo(content, false, IgnoreErrors());
     }
Loading diff…