Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSite isolation issue in the DOM: Networking component
ComponentDOM
Bug ClassLogic Error
Tracker2068648
Fix commitcddc7ce5d382 (firefox) +5/-29
CISA KEVNot listed
CreditedRintaro Kawasugi
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
if
netwerk/protocol/http/HttpBaseChannel.cpp
modified

Files Changed

  • dom/fetch/FetchDriver.cpp
  • ipc/glue/BackgroundUtils.cpp
  • netwerk/base/LoadInfo.h
  • netwerk/base/nsILoadInfo.idl
  • netwerk/ipc/NeckoChannelParams.ipdlh
  • netwerk/protocol/http/HttpBaseChannel.cpp
diff --git a/dom/fetch/FetchDriver.cpp b/dom/fetch/FetchDriver.cpp
index 1f5e4385568..f3bb6cf6d21 100644
--- a/dom/fetch/FetchDriver.cpp
+++ b/dom/fetch/FetchDriver.cpp
@@ -714,14 +714,6 @@ nsresult FetchDriver::HttpFetch(
     }
   }
 
-  if (mDocument && mDocument->GetEmbedderElement() &&
-      mDocument->GetEmbedderElement()->IsAnyOfHTMLElements(nsGkAtoms::object,
-                                                           nsGkAtoms::embed)) {
-    nsCOMPtr<nsILoadInfo> loadInfo = chan->LoadInfo();
-    rv = loadInfo->SetIsFromObjectOrEmbed(true);
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-
   // Insert ourselves into the notification callbacks chain so we can set
   // headers on redirects.
 #ifdef DEBUG
diff --git a/ipc/glue/BackgroundUtils.cpp b/ipc/glue/BackgroundUtils.cpp
index 2251dad0e11..e91cf98b07f 100644
--- a/ipc/glue/BackgroundUtils.cpp
+++ b/ipc/glue/BackgroundUtils.cpp
@@ -602,11 +602,11 @@ nsresult LoadInfoToLoadInfoArgs(nsILoadInfo* aLoadInfo,
       aLoadInfo->GetAllowDeprecatedSystemRequests(),
       aLoadInfo->GetIsInDevToolsContext(), aLoadInfo->GetParserCreatedScript(),
       requestMode, aLoadInfo->GetIsFromProcessingFrameAttributes(),
-      aLoadInfo->GetIsMediaRequest(), aLoadInfo->GetIsFromObjectOrEmbed(),
-      cookieJarSettingsArgs, aLoadInfo->GetRequestBlockingReason(),
-      maybePolicyContainerToInherit, aLoadInfo->GetStoragePermission(),
-      aLoadInfo->GetParentIpAddressSpace(), aLoadInfo->GetIpAddressSpace(),
-      overriddenFingerprintingSettingsArg, aLoadInfo->GetIsMetaRefresh(),
+      aLoadInfo->GetIsMediaRequest(), cookieJarSettingsArgs,
+      aLoadInfo->GetRequestBlockingReason(), maybePolicyContainerToInherit,
+      aLoadInfo->GetStoragePermission(), aLoadInfo->GetParentIpAddressSpace(),
+      aLoadInfo->GetIpAddressSpace(), overriddenFingerprintingSettingsArg,
+      aLoadInfo->GetIsMetaRefresh(),
       aLoadInfo->GetActivatedFromNavigationalPrefetch(),
       aLoadInfo->GetLoadingEmbedderPolicy(),
       aLoadInfo->GetIsOriginTrialCoepCredentiallessEnabledForTopLevel(),
diff --git a/netwerk/base/LoadInfo.h b/netwerk/base/LoadInfo.h
index 7d4eb0f8ef0..64b79c03e4e 100644
--- a/netwerk/base/LoadInfo.h
+++ b/netwerk/base/LoadInfo.h
@@ -205,9 +205,6 @@ nsresult LoadInfoArgsToLoadInfo(const mozilla::net::LoadInfoArgs& aLoadInfoArgs,
   GETTER(bool, IsMediaRequest, isMediaRequest, false)                          \
   SETTER(bool, IsMediaRequest)                                                 \
                                                                                \
-  GETTER(bool, IsFromObjectOrEmbed, isFromObjectOrEmbed, false)                \
-  SETTER(bool, IsFromObjectOrEmbed)                                            \
-                                                                               \
   GETTER(nsILoadInfo::CrossOriginEmbedderPolicy, LoadingEmbedderPolicy,        \
          loadingEmbedderPolicy, nsILoadInfo::EMBEDDER_POLICY_NULL)             \
   SETTER(nsILoadInfo::CrossOriginEmbedderPolicy, LoadingEmbedderPolicy)        \
diff --git a/netwerk/base/nsILoadInfo.idl b/netwerk/base/nsILoadInfo.idl
index 0cde3cee553..1830c86aead 100644
--- a/netwerk/base/nsILoadInfo.idl
+++ b/netwerk/base/nsILoadInfo.idl
@@ -1637,12 +1637,6 @@ interface nsILoadInfo : nsISupports
    */
   [infallible] attribute boolean isMediaRequest;
 
-  /**
-   * This attribute will be true if the fetch request is from object or embed
-   * elements
-   */
-  [infallible] attribute boolean isFromObjectOrEmbed;
-
   /**
    * If this is non-null, this property holds the URI as it was before query
    * stripping was performed.
diff --git a/netwerk/ipc/NeckoChannelParams.ipdlh b/netwerk/ipc/NeckoChannelParams.ipdlh
index 3bf268b3efb..a6ca1b8cb39 100644
--- a/netwerk/ipc/NeckoChannelParams.ipdlh
+++ b/netwerk/ipc/NeckoChannelParams.ipdlh
@@ -208,7 +208,6 @@ struct LoadInfoArgs
   RequestMode?                requestMode;
   bool                        isFromProcessingFrameAttributes;
   bool                        isMediaRequest;
-  bool                        isFromObjectOrEmbed;
   CookieJarSettingsArgs       cookieJarSettings;
   uint32_t                    requestBlockingReason;
   PolicyContainerArgs?        policyContainerToInherit;
diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp
index 0f77e4451c3..77e11d8302b 100644
--- a/netwerk/protocol/http/HttpBaseChannel.cpp
+++ b/netwerk/protocol/http/HttpBaseChannel.cpp
@@ -3414,12 +3414,6 @@ bool HttpBaseChannel::ShouldBlockOpaqueResponse() const {
     return false;
   }
 
-  // Ignore the request from object or embed elements
-  if (mLoadInfo->GetIsFromObjectOrEmbed()) {
-    LOGORB("No block: Request From <object> or <embed>");
-    return false;
-  }
-
   // Exclude no_cors System XHR
   if (extContentPolicyType == ExtContentPolicy::TYPE_XMLHTTPREQUEST) {
     if (securityMode ==
Loading diff…