description: When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
problem types: Use-after-free in file picker dialog
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 94, status: affected, version: unspecified, versionType: custom
}
{
product: Thunderbird
vendor: Mozilla
versions:
lessThan: 91.3, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox ESR
vendor: Mozilla
versions:
lessThan: 91.3, status: affected, version: unspecified, versionType: custom
}
