Firefox · DOM
CVE-2026-12304
Cross Origin in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
mOriginAttributesdom/cookiestore/CookieStoreNotifier.cpp |
modified |
Files Changed
dom/cookiestore/CookieStoreNotifier.cppdom/cookiestore/CookieStoreNotifier.h
Patch
diff --git a/dom/cookiestore/CookieStoreNotifier.cpp b/dom/cookiestore/CookieStoreNotifier.cpp
index 73f2b3e9617..1a6561fea35 100644
--- a/dom/cookiestore/CookieStoreNotifier.cpp
+++ b/dom/cookiestore/CookieStoreNotifier.cpp
@@ -47,13 +47,18 @@ already_AddRefed<CookieStoreNotifier> CookieStoreNotifier::Create(
return nullptr;
}
+ nsCString host;
+ if (NS_WARN_IF(NS_FAILED(principal->GetAsciiHost(host))) || host.IsEmpty()) {
+ return nullptr;
+ }
+
nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
if (NS_WARN_IF(!os)) {
return nullptr;
}
RefPtr<CookieStoreNotifier> notifier = new CookieStoreNotifier(
- aCookieStore, baseDomain, principal->OriginAttributesRef());
+ aCookieStore, baseDomain, host, principal->OriginAttributesRef());
nsresult rv =
os->AddObserver(notifier,
@@ -68,9 +73,10 @@ already_AddRefed<CookieStoreNotifier> CookieStoreNotifier::Create(
CookieStoreNotifier::CookieStoreNotifier(
CookieStore* aCookieStore, const nsACString& aBaseDomain,
- const OriginAttributes& aOriginAttributes)
+ const nsACString& aHost, const OriginAttributes& aOriginAttributes)
: mCookieStore(aCookieStore),
mBaseDomain(aBaseDomain),
+ mHost(aHost),
mOriginAttributes(aOriginAttributes) {
MOZ_ASSERT(NS_IsMainThread());
MOZ_ASSERT(aCookieStore);
@@ -129,6 +135,10 @@ CookieStoreNotifier::Observe(nsISupports* aSubject, const char* aTopic,
return NS_OK;
}
+ if (!net::CookieCommons::DomainMatches(net::Cookie::Cast(cookie), mHost)) {
+ return NS_OK;
+ }
+
bool isHttpOnly;
rv = cookie->GetIsHttpOnly(&isHttpOnly);
if (NS_WARN_IF(NS_FAILED(rv))) {
diff --git a/dom/cookiestore/CookieStoreNotifier.h b/dom/cookiestore/CookieStoreNotifier.h
index 7eefee65b35..b064293fc3e 100644
--- a/dom/cookiestore/CookieStoreNotifier.h
+++ b/dom/cookiestore/CookieStoreNotifier.h
@@ -30,6 +30,7 @@ class CookieStoreNotifier final : public nsIObserver {
private:
CookieStoreNotifier(CookieStore* aCookieStore, const nsACString& aBaseDomain,
+ const nsACString& aHost,
const OriginAttributes& aOriginAttributes);
~CookieStoreNotifier();
@@ -39,6 +40,7 @@ class CookieStoreNotifier final : public nsIObserver {
CookieStore* mCookieStore;
nsCString mBaseDomain;
+ nsCString mHost;
OriginAttributes mOriginAttributes;
nsTArray<RefPtr<Event>> mDelayedDOMEvents;
Loading diff…
References
On This Page