High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Streams component
ComponentDOM
Bug ClassLogic Error
Tracker2068433
Fix commit168f1683dcbc (firefox) +4/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Files Changed

  • dom/streams/ReadableByteStreamController.cpp
diff --git a/dom/streams/ReadableByteStreamController.cpp b/dom/streams/ReadableByteStreamController.cpp
index cffa45777fd..b5c9c9b2274 100644
--- a/dom/streams/ReadableByteStreamController.cpp
+++ b/dom/streams/ReadableByteStreamController.cpp
@@ -826,6 +826,10 @@ MOZ_CAN_RUN_SCRIPT void ReadableByteStreamControllerFillReadRequestFromQueue(
   // byte offset, entry’s byte length »).
   aRv.MightThrowJSException();
   JS::Rooted<JSObject*> buffer(aCx, entry->Buffer());
+  if (!JS_WrapObject(aCx, &buffer)) {
+    aRv.StealExceptionFromJSContext(aCx);
+    return;
+  }
   JS::Rooted<JSObject*> view(
       aCx, JS_NewUint8ArrayWithBuffer(aCx, buffer, entry->ByteOffset(),
                                       int64_t(entry->ByteLength())));
Loading diff…