PatchGap
Firefox · DOM

CVE-2026-117992

Policy Bypass in DOM
Moderate firefox Policy Bypass 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInformation disclosure in the CSS Parsing and Computation component
ComponentDOM
Bug ClassPolicy Bypass
Tracker2079709
Fix commit84a086f1499d (firefox) +2/-6
CISA KEVNot listed
CreditedTakashi Suzuki
Disclosed2026-10-27

Background

SVG used as an image
When an SVG is loaded via <img>, background-image, etc., it is rendered in a restricted “image document” mode. To preserve privacy/security it must not behave like a full document; in particular it is heavily restricted in what external content it may load.
`Document::IsBeingUsedAsImage()` / `mIsBeingUsedAsImage`
Flag marking a Document as an image document.
Display document (`GetDisplayDocument` / `SetDisplayDocument`)
Some resource documents (e.g. an SVG resource) have an associated “display document” they are presented within. mHasDisplayDocument/mDisplayDocument track this relationship.
`nsDataDocumentContentPolicy::ShouldLoad`
A content-policy hook that decides whether a load is allowed. For SVG-as-image it enforces that content may only come from URIs that are local and inherit the security context (data URIs, etc.).

Root Cause Analysis

The “used as an image” restriction in nsDataDocumentContentPolicy::ShouldLoad (dom/base/nsDataDocumentContentPolicy.cpp) was keyed off the wrong document. The old code computed docToCheckForImage = doc->GetDisplayDocument() and fell back to doc only when there was no display document, then applied the SVG-as-image URI restrictions to that chosen document. The flaw is that the image-document status was not reliably reflected on the document the policy actually consulted: when a document had a display document, the policy checked the display document’s IsBeingUsedAsImage(), which was not set to mirror the underlying image-resource document. As a result the restrictive branch could be skipped, letting an SVG-as-image load external content it should not — the privacy/info-disclosure leak the advisory describes.

The patch fixes this on two sides. Document::SetDisplayDocument (dom/base/Document.h) now propagates the flag: mIsBeingUsedAsImage |= aDisplayDocument->mIsBeingUsedAsImage;, so a document whose display document is an image document is itself marked as used-as-image. With the flag reliably present on the document, ShouldLoad is simplified to test doc->IsBeingUsedAsImage() directly, dropping the GetDisplayDocument() indirection that previously selected the wrong document to check. This classifies as a content-policy bypass (the diff shows the restriction being applied to the right document); the advisory labels it information disclosure, which is the impact of letting a restricted SVG-as-image reach external resources.

Key insight
The SVG-as-image load restriction was evaluated against the display document (or the propagation of the image flag to it was missing), so an image document’s “used as an image” status did not govern the content-policy check — letting an SVG-as-image bypass its URI restrictions and load external content.

Attack Path

  1. Serve a malicious SVG Attacker provides an SVG that a victim loads as an image (<img>, CSS background-image, etc.). (reachability inferred)
  2. Display-document relationship The SVG’s resource/display-document arrangement is such that the pre-patch ShouldLoad consulted a document whose IsBeingUsedAsImage() was not set.
  3. Restriction skipped Because the checked document was not flagged as an image document, ShouldLoad did not enforce the “local + inherits security context” URI restriction for the SVG.
  4. External load The SVG triggers a load to an external URI that should have been blocked for an image document.
  5. Primitive The external request leaks information (resource existence/timing, and disallowed cross-context content retrieval) from the image-rendering context — an information-disclosure/privacy bypass.

Impact Assessment

This is content-process document/content-policy code reachable from ordinary web content (any page or resource that can cause a victim to render an attacker’s SVG as an image); no special privilege is required. The diff restores the SVG-as-image URI restriction by ensuring the image-document flag is propagated to, and checked on, the correct document. Impact is a content-policy bypass whose consequence is information disclosure (the advisory’s stated class) — unauthorized external loads from an SVG-as-image context — rather than memory corruption. Rated moderate.

Changed Functions

FunctionChangeNotes
if
dom/base/nsDataDocumentContentPolicy.cpp
 modified

Files Changed

  • dom/base/Document.h
  • dom/base/nsDataDocumentContentPolicy.cpp

Audit Directions

  • Image-document flag propagation
    Audit other places that read IsBeingUsedAsImage() to confirm they see the flag on documents linked via display/resource-document relationships, now that propagation is centralized in SetDisplayDocument.
  • Display-document indirection in security checks
    Search for other security/content-policy checks that use GetDisplayDocument() (or similar indirection) to pick which document to evaluate, which can select a document lacking the relevant restriction flags.
  • SVG-as-image load restrictions
    Review all enforcement points of the “SVG used as image may only load local/inheriting URIs” rule for other paths that could reach them with the wrong document or an unset flag.

Patch

view commit
diff --git a/dom/base/Document.h b/dom/base/Document.h
index 9d8b51a1625..b088fe37269 100644
--- a/dom/base/Document.h
+++ b/dom/base/Document.h
@@ -2862,6 +2862,7 @@ class Document : public nsINode,
                "Display documents should not nest");
     mDisplayDocument = aDisplayDocument;
     mHasDisplayDocument = !!aDisplayDocument;
+    mIsBeingUsedAsImage |= aDisplayDocument->mIsBeingUsedAsImage;
   }
 
   /**
diff --git a/dom/base/nsDataDocumentContentPolicy.cpp b/dom/base/nsDataDocumentContentPolicy.cpp
index 7b421192a21..0bae94ab7ca 100644
--- a/dom/base/nsDataDocumentContentPolicy.cpp
+++ b/dom/base/nsDataDocumentContentPolicy.cpp
@@ -97,12 +97,7 @@ nsDataDocumentContentPolicy::ShouldLoad(nsIURI* aContentLocation,
     }
   }
 
-  mozilla::dom::Document* docToCheckForImage = doc->GetDisplayDocument();
-  if (!docToCheckForImage) {
-    docToCheckForImage = doc;
-  }
-
-  if (docToCheckForImage->IsBeingUsedAsImage()) {
+  if (doc->IsBeingUsedAsImage()) {
     // We only allow SVG images to load content from URIs that are local and
     // also satisfy one of the following conditions:
     //  - URI inherits security context, e.g. data URIs
Loading diff…
On This Page