Firefox · Toolkit
CVE-2026-100824
Logic Error in Toolkit
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
receiveMessagetoolkit/actors/ContentMetaParent.sys.mjs |
modified | |
iftoolkit/actors/ContentMetaParent.sys.mjs |
modified |
Files Changed
toolkit/actors/ContentMetaChild.sys.mjstoolkit/actors/ContentMetaParent.sys.mjs
Patch
diff --git a/toolkit/actors/ContentMetaChild.sys.mjs b/toolkit/actors/ContentMetaChild.sys.mjs
index 2d8baf79476..c6c80668ca7 100644
--- a/toolkit/actors/ContentMetaChild.sys.mjs
+++ b/toolkit/actors/ContentMetaChild.sys.mjs
@@ -180,7 +180,6 @@ export class ContentMetaChild extends JSWindowActorChild {
// Save description and preview image to moz_places
this.sendAsyncMessage("Meta:SetPageInfo", {
- url,
description: entry.description.value,
previewImageURL: entry.image.value,
});
diff --git a/toolkit/actors/ContentMetaParent.sys.mjs b/toolkit/actors/ContentMetaParent.sys.mjs
index fa7f1fe3bd6..f3d4397e25f 100644
--- a/toolkit/actors/ContentMetaParent.sys.mjs
+++ b/toolkit/actors/ContentMetaParent.sys.mjs
@@ -2,18 +2,27 @@
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+const ACCEPTED_PROTOCOLS = new Set(["http:", "https:"]);
+
export class ContentMetaParent extends JSWindowActorParent {
receiveMessage(message) {
if (message.name == "Meta:SetPageInfo") {
let browser = this.manager.browsingContext.top.embedderElement;
if (browser) {
+ let { description, previewImageURL } = message.data;
+ if (previewImageURL) {
+ let url = URL.parse(previewImageURL);
+ if (!url || !ACCEPTED_PROTOCOLS.has(url.protocol)) {
+ previewImageURL = null;
+ }
+ }
let event = new browser.documentGlobal.CustomEvent("pageinfo", {
bubbles: true,
cancelable: false,
detail: {
- url: message.data.url,
- description: message.data.description,
- previewImageURL: message.data.previewImageURL,
+ url: this.manager.documentURI.spec,
+ description,
+ previewImageURL,
},
});
browser.dispatchEvent(event);
Loading diff…
References
On This Page