[tor-bugs] #26705 [Applications/Tor Browser]: BUG Report ! Use after Free Vulnerability

[Tor Bug Tracker & Wiki]

#26705: BUG Report ! Use after Free Vulnerability
--------------------------------------+-----------------------------------
 Reporter:  t4rkd3vilz                |          Owner:  tbb-team
     Type:  project                   |         Status:  needs_information
 Priority:  Very High                 |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:                            |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+-----------------------------------

Comment (by boklm):

 Some questions:

 - on which OS are you seeing this issue? So far we have tried loading the
 2 html pages in 2 tabs on Linux, Windows 7 and macOS 10.11 without being
 able to reproduce the issue.

 - In the screenshots, you seem to be loading the pages locally (with
 file:/// URLs). Does this issue only happen with local pages, or can you
 reproduce it when loading them with http?

 - In `tor2.png` it looks like you open the second page using the file
 manager. Can you reproduce the issue by copy pasting the address in the
 URL bar instead of using the file manager to open it? The error in `crash
 tor 3.png` looks like an error you would get if you try to run more than
 one instance of the browser. So the issue might be how the file manager
 has been configured to open new pages in Tor Browser.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26705#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online