description: By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
problem types: Use-after-free in DocumentL10n::TranslateDocument
affected:
{
vendor: Mozilla
product: Thunderbird
versions:
version: unspecified, lessThan: 91.8, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Firefox
versions:
version: unspecified, lessThan: 99, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Firefox ESR
versions:
version: unspecified, lessThan: 91.8, status: affected, versionType: custom
}
