Firefox · Widget
CVE-2026-109740
Logic Error in Widget
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifwidget/windows/nsClipboard.cpp |
modified |
Files Changed
widget/windows/nsClipboard.cpp
Patch
diff --git a/widget/windows/nsClipboard.cpp b/widget/windows/nsClipboard.cpp
index 15359f6c902..b7930edbae1 100644
--- a/widget/windows/nsClipboard.cpp
+++ b/widget/windows/nsClipboard.cpp
@@ -370,6 +370,9 @@ nsresult nsClipboard::SetupNativeDataObject(
mozilla::widget::WebCustomFormatMap webCustomFormatMap;
uint32_t webCustomFormatIndex = 0;
+ bool hasText = false;
+ bool hasFilePromise = false;
+
// Walk through flavors that contain data and register them
// into the DataObj as supported flavors
for (uint32_t i = 0; i < flavors.Length(); i++) {
@@ -404,6 +407,11 @@ nsresult nsClipboard::SetupNativeDataObject(
SET_FORMATETC(fe, format, 0, DVASPECT_CONTENT, -1, TYMED_HGLOBAL);
dObj->AddDataFlavor(flavorStr.get(), &fe);
+ if (flavorStr.EqualsLiteral(kFilePromiseMime) ||
+ flavorStr.EqualsLiteral(kFilePromiseURLMime)) {
+ hasFilePromise = true;
+ }
+
// Do various things internal to the implementation, like map one
// flavor to another or add additional flavors based on what's required
// for the win32 impl.
@@ -413,9 +421,7 @@ nsresult nsClipboard::SetupNativeDataObject(
FORMATETC textFE;
SET_FORMATETC(textFE, CF_TEXT, 0, DVASPECT_CONTENT, -1, TYMED_HGLOBAL);
dObj->AddDataFlavor(kTextMime, &textFE);
- if (aMightNeedToFlush) {
- *aMightNeedToFlush = MightNeedToFlush::Yes;
- }
+ hasText = true;
} else if (flavorStr.EqualsLiteral(kHTMLMime)) {
// if we find text/html, also advertise win32's html flavor (which we will
// convert on our own in nsDataObj::GetText().
@@ -489,6 +495,20 @@ nsresult nsClipboard::SetupNativeDataObject(
}
}
+ if (aMightNeedToFlush) {
+ // We flush in order to stop Windows Suggested Actions walking the a11y
+ // tree, which it only does for text (bug 1774285). Rendering a file
+ // promise, however, fetches the promised URL under a nested event loop, so
+ // a transferable carrying both would trade the tree walk for a main-thread
+ // network fetch. We choose the tree-walk penalty instead, in this case.
+ // This means that bug 1774285 reappears for that combination. However,
+ // the combination would naturally be very rare (clipboard ops including
+ // both text and files simultaneously are not common) and should be
+ // impossible while clipboard.imageAsFile.enabled is false (the default).
+ *aMightNeedToFlush = hasText && !hasFilePromise ? MightNeedToFlush::Yes
+ : MightNeedToFlush::No;
+ }
+
if (!webCustomFormatMap.IsEmpty()) {
// Publish the web-custom-format map alongside the per-slot payloads.
// The JSON is held on the data object so nsDataObj::GetText can serve
Loading diff…
References
On This Page