PatchGap
Firefox · Core

CVE-2026-109766

Logic Error in Core
Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the Enterprise Policies component
ComponentCore
Bug ClassLogic Error
Tracker2074406
Fix commit79fa5a4a95b2 (firefox) +10/-3
CISA KEVNot listed
CreditedSouma Ohsawa
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
shouldLoad
browser/components/enterprisepolicies/helpers/WebsiteFilter.sys.mjs
 modified
if
browser/components/enterprisepolicies/helpers/WebsiteFilter.sys.mjs
 modified

Files Changed

  • browser/components/enterprisepolicies/helpers/WebsiteFilter.sys.mjs
  • browser/components/enterprisepolicies/tests/browser/browser_policy_websitefilter.js

Patch

view commit
diff --git a/browser/components/enterprisepolicies/helpers/WebsiteFilter.sys.mjs b/browser/components/enterprisepolicies/helpers/WebsiteFilter.sys.mjs
index 0f4350767d5..d217b2de3e0 100644
--- a/browser/components/enterprisepolicies/helpers/WebsiteFilter.sys.mjs
+++ b/browser/components/enterprisepolicies/helpers/WebsiteFilter.sys.mjs
@@ -157,11 +157,11 @@ export let WebsiteFilter = {
 
   shouldLoad(contentLocation, loadInfo) {
     let contentType = loadInfo.externalContentPolicyType;
-    let url = contentLocation.spec.toLowerCase();
+    let url = contentLocation.spec;
     if (contentLocation.scheme == "view-source") {
       url = contentLocation.pathQueryRef;
-    } else if (url.startsWith("about:reader?")) {
-      url = lazy.ReaderMode.getOriginalUrl(url);
+    } else if (url.toLowerCase().startsWith("about:reader?")) {
+      url = lazy.ReaderMode.getOriginalUrl("about:reader?" + url.substring(13));
     }
     if (
       contentType == Ci.nsIContentPolicy.TYPE_DOCUMENT ||
diff --git a/browser/components/enterprisepolicies/tests/browser/browser_policy_websitefilter.js b/browser/components/enterprisepolicies/tests/browser/browser_policy_websitefilter.js
index c19b42f393e..15895a128d4 100644
--- a/browser/components/enterprisepolicies/tests/browser/browser_policy_websitefilter.js
+++ b/browser/components/enterprisepolicies/tests/browser/browser_policy_websitefilter.js
@@ -66,6 +66,13 @@ add_task(async function test_http() {
       encodeURIComponent(SUPPORT_FILES_PATH + BLOCKED_PAGE),
     true
   );
+  await checkBlockedPage(
+    "about:reader?URL=" +
+      encodeURIComponent(SUPPORT_FILES_PATH + EXCEPTION_PAGE) +
+      "&url=" +
+      encodeURIComponent(SUPPORT_FILES_PATH + BLOCKED_PAGE),
+    true
+  );
   await checkBlockedPage(SUPPORT_FILES_PATH + EXCEPTION_PAGE, false);
 
   await checkBlockedPage(SUPPORT_FILES_PATH + "301.sjs", true);
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/browser/components/enterprisepolicies/tests/browser/browser_policy_websitefilter.js b/browser/components/enterprisepolicies/tests/browser/browser_policy_websitefilter.js
index c19b42f393e..15895a128d4 100644
--- a/browser/components/enterprisepolicies/tests/browser/browser_policy_websitefilter.js
+++ b/browser/components/enterprisepolicies/tests/browser/browser_policy_websitefilter.js
@@ -66,6 +66,13 @@ add_task(async function test_http() {
       encodeURIComponent(SUPPORT_FILES_PATH + BLOCKED_PAGE),
     true
   );
+  await checkBlockedPage(
+    "about:reader?URL=" +
+      encodeURIComponent(SUPPORT_FILES_PATH + EXCEPTION_PAGE) +
+      "&url=" +
+      encodeURIComponent(SUPPORT_FILES_PATH + BLOCKED_PAGE),
+    true
+  );
   await checkBlockedPage(SUPPORT_FILES_PATH + EXCEPTION_PAGE, false);
 
   await checkBlockedPage(SUPPORT_FILES_PATH + "301.sjs", true);
Loading diff…
On This Page