Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the DOM: Security component
ComponentDOM
Bug ClassLogic Error
Tracker2063005
Fix commit38628560257a (firefox) +12/-0
CISA KEVNot listed
Creditedhamayanhamayan
Disclosed2026-10-13

Files Changed

  • dom/jsurl/nsJSProtocolHandler.cpp
diff --git a/dom/jsurl/nsJSProtocolHandler.cpp b/dom/jsurl/nsJSProtocolHandler.cpp
index 652ed373efa..d9e9781a478 100644
--- a/dom/jsurl/nsJSProtocolHandler.cpp
+++ b/dom/jsurl/nsJSProtocolHandler.cpp
@@ -59,7 +59,9 @@
 #include "nsThreadUtils.h"
 
 using mozilla::IsAscii;
+using mozilla::Maybe;
 using mozilla::dom::AutoEntryScript;
+using mozilla::dom::PermissionsPolicyInfo;
 
 static NS_DEFINE_CID(kJSURICID, NS_JSURI_CID);
 
@@ -334,6 +336,16 @@ nsresult JSURLInputStream::EvaluateScript(
         return NS_ERROR_DOM_RETVAL_UNDEFINED;
       }
     }
+
+    // If the original channel's nsILoadInfo has a PermissionsPolicyInfo,
+    // copy it to the new channel.
+    if (nsCOMPtr<nsIChannel> originalChannel = targetDoc->GetChannel()) {
+      nsCOMPtr<nsILoadInfo> originalLoadInfo = originalChannel->LoadInfo();
+      if (Maybe<PermissionsPolicyInfo> containerPolicy =
+              originalLoadInfo->GetContainerPermissionsPolicyInfo()) {
+        loadInfo->SetContainerPermissionsPolicyInfo(*containerPolicy);
+      }
+    }
   }
 
   // Push our popup control state
Loading diff…