Firefox · Networking
CVE-2025-6432
Logic Error in Networking
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifnetwerk/base/nsIOService.cpp |
modified | |
getInterfacetoolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs |
modified | |
constructortoolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs |
modified |
Files Changed
netwerk/base/nsIOService.cpptoolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
Patch
diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp
index e957628acc2..ab96edf9e16 100644
--- a/netwerk/base/nsIOService.cpp
+++ b/netwerk/base/nsIOService.cpp
@@ -2190,6 +2190,10 @@ nsresult nsIOService::SpeculativeConnectInternal(
loadFlags |= nsIRequest::LOAD_ANONYMOUS;
channel->SetLoadFlags(loadFlags);
}
+ if (aCallbacks) {
+ rv = channel->SetNotificationCallbacks(aCallbacks);
+ NS_ENSURE_SUCCESS(rv, rv);
+ }
nsCOMPtr<nsICancelable> cancelable;
RefPtr<IOServiceProxyCallback> callback = new IOServiceProxyCallback(
diff --git a/toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs b/toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
index 0745607f549..bef43e68d4c 100644
--- a/toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
+++ b/toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
@@ -8,6 +8,18 @@ ChromeUtils.defineESModuleGetters(lazy, {
PrivateBrowsingUtils: "resource://gre/modules/PrivateBrowsingUtils.sys.mjs",
});
+function NotificationCallbacks(browser) {
+ this._browser = browser;
+}
+NotificationCallbacks.prototype = {
+ QueryInterface: ChromeUtils.generateQI(["nsIInterfaceRequestor"]),
+ getInterface(iid) {
+ if (iid.equals(Ci.nsILoadContext)) {
+ return this._browser.browsingContext;
+ }
+ },
+};
+
// This object implements the JS parts of nsIWebNavigation.
export class RemoteWebNavigation {
constructor(aBrowser) {
@@ -109,7 +121,12 @@ export class RemoteWebNavigation {
attrs
);
}
- Services.io.speculativeConnect(uri, principal, null, false);
+ Services.io.speculativeConnect(
+ uri,
+ principal,
+ new NotificationCallbacks(this._browser),
+ false
+ );
}
} catch (ex) {
// Can't setup speculative connection for this uri for some
Loading diff…
References
On This Page