description: When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 52 and Thunderbird < 52.
problem types: Use-after-free using addRange to add range to an incorrect root object
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 52, status: affected, version: unspecified, versionType: custom
}
{
product: Thunderbird
vendor: Mozilla
versions:
lessThan: 52, status: affected, version: unspecified, versionType: custom
}
