PatchGap
Firefox · Networking

CVE-2026-109755

Logic Error in Networking
Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSandbox escape in the DOM: Content Processes component
ComponentNetworking
Bug ClassLogic Error
Tracker2068448
Fix commitf8ae3ce8f812 (firefox) +2/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Files Changed

  • netwerk/ipc/DocumentChannelChild.cpp

Patch

view commit
diff --git a/netwerk/ipc/DocumentChannelChild.cpp b/netwerk/ipc/DocumentChannelChild.cpp
index 2a85d78c812..d9d5ed4bc5d 100644
--- a/netwerk/ipc/DocumentChannelChild.cpp
+++ b/netwerk/ipc/DocumentChannelChild.cpp
@@ -229,6 +229,8 @@ IPCResult DocumentChannelChild::RecvRedirectToRealChannel(
   LOG(("DocumentChannelChild RecvRedirectToRealChannel [this=%p, uri=%s]", this,
        aArgs.uri()->GetSpecOrDefault().get()));
 
+  ContentChild::MaybeBecomeUntrusted();
+
   // The document that created the cspToInherit.
   // This is used when deserializing LoadInfo from the parent
   // process, since we can't serialize Documents directly.
Loading diff…
On This Page