High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Navigation component
ComponentCore
Bug ClassLogic Error
Tracker2068361
Fix commitdefbd6d2a9a1 (firefox) +10/-4
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
mTooltipShownOnce
docshell/base/nsDocShellTreeOwner.cpp
modified
if
docshell/base/nsDocShellTreeOwner.cpp
modified

Files Changed

  • docshell/base/nsDocShellTreeOwner.cpp
diff --git a/docshell/base/nsDocShellTreeOwner.cpp b/docshell/base/nsDocShellTreeOwner.cpp
index 8356647a0d9..521d93f3919 100644
--- a/docshell/base/nsDocShellTreeOwner.cpp
+++ b/docshell/base/nsDocShellTreeOwner.cpp
@@ -966,7 +966,11 @@ ChromeTooltipListener::ChromeTooltipListener(nsWebBrowser* aInBrowser,
       mShowingTooltip(false),
       mTooltipShownOnce(false) {}
 
-ChromeTooltipListener::~ChromeTooltipListener() = default;
+ChromeTooltipListener::~ChromeTooltipListener() {
+  if (mTooltipTimer) {
+    mTooltipTimer->Cancel();
+  }
+}
 
 nsITooltipTextProvider* ChromeTooltipListener::GetTooltipTextProvider() {
   if (!mTooltipTextProvider) {
@@ -1229,7 +1233,8 @@ bool ChromeTooltipListener::WebProgressShowedTooltip(
 //   -- the dom node the user hovered over    (mPossibleTooltipNode)
 void ChromeTooltipListener::sTooltipCallback(nsITimer* aTimer,
                                              void* aChromeTooltipListener) {
-  auto* self = static_cast<ChromeTooltipListener*>(aChromeTooltipListener);
+  RefPtr<ChromeTooltipListener> self =
+      static_cast<ChromeTooltipListener*>(aChromeTooltipListener);
   if (!self || !self->mPossibleTooltipNode) {
     return;
   }
@@ -1268,8 +1273,9 @@ void ChromeTooltipListener::sTooltipCallback(nsITimer* aTimer,
                                getter_Copies(tooltipText),
                                getter_Copies(directionText), &textFound);
 
-  if (textFound && (!self->mTooltipShownOnce ||
-                    tooltipText != self->mLastShownTooltipText)) {
+  if (self->mPossibleTooltipNode && textFound &&
+      (!self->mTooltipShownOnce ||
+       tooltipText != self->mLastShownTooltipText)) {
     // ShowTooltip expects screen-relative position.
     self->ShowTooltip(self->mMouseScreenPoint.x, self->mMouseScreenPoint.y,
                       tooltipText, directionText);
Loading diff…