High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionPrivilege escalation in the DOM: Navigation component
ComponentToolkit
Bug ClassLogic Error
Tracker2075440
Fix commit44c8fd8df124 (firefox) +1/-0
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-10-27

Files Changed

  • toolkit/components/pdfjs/content/PdfEmbedFallbackParent.sys.mjs
diff --git a/toolkit/components/pdfjs/content/PdfEmbedFallbackParent.sys.mjs b/toolkit/components/pdfjs/content/PdfEmbedFallbackParent.sys.mjs
index 2088c7f03a0..952d08d39b4 100644
--- a/toolkit/components/pdfjs/content/PdfEmbedFallbackParent.sys.mjs
+++ b/toolkit/components/pdfjs/content/PdfEmbedFallbackParent.sys.mjs
@@ -61,6 +61,7 @@ export class PdfEmbedFallbackParent extends JSWindowActorParent {
     // The converter keeps the PDF URI as the fallback document's URI.
     fallback.browsingContext.loadURI(fallback.documentURI, {
       triggeringPrincipal: embedder.documentPrincipal,
+      triggeringRemoteType: embedder.remoteType,
       referrerInfo: lazy.E10SUtils.deserializeReferrerInfo(data?.referrerInfo),
     });
   }
Loading diff…