Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionSpoofing issue in the Address Bar component.
ComponentCore
Bug ClassLogic Error
Tracker1976102
Fix commit26c31e8d376b (firefox) +30/-11
CISA KEVNot listed
CreditedRenwa
Disclosed2025-08-19

Changed Functions

FunctionChangeNotes
if
browser/components/urlbar/UrlbarInput.sys.mjs
modified
if
browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs
modified

Files Changed

  • browser/components/urlbar/UrlbarInput.sys.mjs
  • browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs
diff --git a/browser/components/urlbar/UrlbarInput.sys.mjs b/browser/components/urlbar/UrlbarInput.sys.mjs
index 666999f3a99..db1a780f36d 100644
--- a/browser/components/urlbar/UrlbarInput.sys.mjs
+++ b/browser/components/urlbar/UrlbarInput.sys.mjs
@@ -3936,11 +3936,17 @@ export class UrlbarInput {
     // do the work for the first time.
     let firstView = (!isSameDocument && !dueToTabSwitch) || !state.persist;
 
+    let cachedUriDidChange =
+      state.persist?.originalURI &&
+      !state.persist.originalURI.equals(
+        this.window.gBrowser.selectedBrowser.originalURI
+      );
+
     // Capture the shouldPersist property if it exists before
     // setPersistenceState potentially modifies it.
     let wasPersisting = state.persist?.shouldPersist ?? false;
 
-    if (firstView) {
+    if (firstView || cachedUriDidChange) {
       lazy.UrlbarSearchTermsPersistence.setPersistenceState(
         state,
         this.window.gBrowser.selectedBrowser.originalURI
diff --git a/browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs b/browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs
index 0df0e233f57..cca446c2b6b 100644
--- a/browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs
+++ b/browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs
@@ -242,17 +242,21 @@ class _UrlbarSearchTermsPersistence {
       return false;
     }
 
-    let origin;
+    let origin, pathname;
     try {
-      origin = URL.fromURI(uri)?.origin;
+      let url = URL.fromURI(uri);
+      origin = url.origin;
+      pathname = url.pathname;
     } catch (ex) {
       return false;
     }
 
     // Bug 1972464: Prevent search terms from persisting across different origin
-    // due to a possible race condition. This check prevents cross-origin
-    // persistence until the persistence logic is refactored.
-    if (origin !== state.persist.origin) {
+    // or pathnames. This should be refactored later to be simplified.
+    if (
+      origin !== state.persist.origin ||
+      pathname !== state.persist.pathname
+    ) {
       return false;
     }
 
@@ -265,13 +269,18 @@ class _UrlbarSearchTermsPersistence {
       // Whether the engine that loaded the URI is the default search engine.
       isDefaultEngine: null,
 
-      // Temporary until we resolve Bug 1972464: Cache origin for validation
-      // checks. This should be removed once the architecture is refactored.
+      // Temporary until we resolve Bug 1972464 - refactor the architecture.
       origin: null,
 
       // The name of the engine that was used to load the URI.
       originalEngineName: null,
 
+      // Temporary until we resolve Bug 1972464 - refactor the architecture.
+      originalURI: null,
+
+      // Temporary until we resolve Bug 1972464 - refactor the architecture.
+      path: null,
+
       // The search provider associated with the URI. If one exists, it means
       // we have custom rules for this search provider to determine whether or
       // not the URI corresponds to a default search engine results page.
@@ -284,21 +293,25 @@ class _UrlbarSearchTermsPersistence {
       shouldPersist: null,
     };
 
-    let origin;
+    let origin, pathname;
     try {
-      origin = URL.fromURI(uri)?.origin;
+      let url = URL.fromURI(uri);
+      origin = url.origin;
+      pathname = url.pathname;
     } catch (ex) {
       return;
     }
 
     let searchTerms = this.getSearchTerm(uri);
     // Avoid setting state if either are missing.
-    if (!searchTerms || !origin) {
+    if (!searchTerms || !origin || !pathname) {
       return;
     }
 
     state.persist.origin = origin;
     state.persist.searchTerms = searchTerms;
+    state.persist.pathname = pathname;
+    state.persist.originalURI = uri;
 
     let provider = this.#getProviderInfoForURL(uri?.spec);
     // If we have specific Remote Settings defined providers for the URL,
Loading diff…