Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionA clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page.
ComponentToolkit
Bug ClassLogic Error
Tracker1954137
Fix commit1f1a1333169d (firefox) +14/-4
CISA KEVNot listed
CreditedAmeen Basha M K
Disclosed2025-05-27

Changed Functions

FunctionChangeNotes
if
toolkit/actors/AutoCompleteParent.sys.mjs
modified
notifyListeners
toolkit/actors/AutoCompleteParent.sys.mjs
modified

Files Changed

  • toolkit/actors/AutoCompleteParent.sys.mjs
diff --git a/toolkit/actors/AutoCompleteParent.sys.mjs b/toolkit/actors/AutoCompleteParent.sys.mjs
index 4dd0292d364..dc0b634e040 100644
--- a/toolkit/actors/AutoCompleteParent.sys.mjs
+++ b/toolkit/actors/AutoCompleteParent.sys.mjs
@@ -8,6 +8,7 @@ const lazy = {};
 
 ChromeUtils.defineESModuleGetters(lazy, {
   GeckoViewAutocomplete: "resource://gre/modules/GeckoViewAutocomplete.sys.mjs",
+  clearTimeout: "resource://gre/modules/Timer.sys.mjs",
   setTimeout: "resource://gre/modules/Timer.sys.mjs",
 });
 
@@ -471,10 +472,19 @@ export class AutoCompleteParent extends JSWindowActorParent {
     );
     items.forEach(item => (item.disabled = true));
 
-    lazy.setTimeout(
-      () => items.forEach(item => (item.disabled = false)),
-      popupDelay
-    );
+    let timerId;
+    const delay = () => {
+      if (timerId) {
+        lazy.clearTimeout(timerId);
+      }
+      timerId = lazy.setTimeout(() => {
+        items.forEach(item => (item.disabled = false));
+        this.openedPopup?.removeEventListener("click", delay);
+      }, popupDelay);
+    };
+
+    this.openedPopup.addEventListener("click", delay);
+    delay();
   }
 
   notifyListeners() {
Loading diff…