Bug 2411993 (CVE-2025-29699)

A use after free flaw has been discovered in NetSurf. The Node.textContent setter is handled by libdom's _dom_node_set_text_content function, which removes the specified node's children and replaces them with a single text node. It calls dom_node_remove_child in a loop to detach each child node from the tree. After each call, it decrements the child node's reference count via dom_node_unref, which causes the node to be freed if the count drops to 0. If a registered handler sets the parent node's text content again, a nested call to _dom_node_set_text_content will occur, and the node's children may be freed due to the reference count decrement. When the event dispatcher of the original call chain resumes execution, it may access a freed child, resulting in a use-after-free.