Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionAn attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks.
ComponentLayout
Bug ClassLogic Error
Tracker1909535
Fix commitd0e24c06b1e5 (firefox) +12/-0
CISA KEVNot listed
CreditedShaheen Fazim
Disclosed2024-11-26

Changed Functions

FunctionChangeNotes
open
toolkit/actors/SelectParent.sys.mjs
modified

Files Changed

  • layout/forms/HTMLSelectEventListener.cpp
  • toolkit/actors/SelectParent.sys.mjs
diff --git a/layout/forms/HTMLSelectEventListener.cpp b/layout/forms/HTMLSelectEventListener.cpp
index 10ed410ee0e..e593b465677 100644
--- a/layout/forms/HTMLSelectEventListener.cpp
+++ b/layout/forms/HTMLSelectEventListener.cpp
@@ -403,6 +403,10 @@ nsresult HTMLSelectEventListener::MouseDown(dom::Event* aMouseEvent) {
     return NS_OK;
   }
 
+  if (!IsInActiveTab(mElement->OwnerDoc())) {
+    return NS_OK;
+  }
+
   // only allow selection with the left button
   // if a right button click is on the combobox itself
   // or on the select when in listbox mode, then let the click through
diff --git a/toolkit/actors/SelectParent.sys.mjs b/toolkit/actors/SelectParent.sys.mjs
index f92c6e81353..1eaf4f3b464 100644
--- a/toolkit/actors/SelectParent.sys.mjs
+++ b/toolkit/actors/SelectParent.sys.mjs
@@ -281,6 +281,14 @@ export var SelectParentHelper = {
   },
 
   open(browser, menulist, rect, isOpenedViaTouch, selectParentActor) {
+    if (
+      (browser && !browser.browsingContext.isActive) ||
+      !menulist.ownerDocument.hasFocus()
+    ) {
+      selectParentActor.sendAsyncMessage("Forms:DismissedDropDown", {});
+      return;
+    }
+
     this._actor = selectParentActor;
     menulist.hidden = false;
     this._currentBrowser = browser;
Loading diff…