Medium firefox Cross Origin 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSame-origin policy bypass in the Networking: Cookies component
ComponentDOM
Bug ClassCross Origin
Tracker2034944
Fix commitd0b8a022bca3 (firefox) +14/-2
CISA KEVNot listed
CreditedYaqoub Aldurayhim
Disclosed2026-06-16

Changed Functions

FunctionChangeNotes
mOriginAttributes
dom/cookiestore/CookieStoreNotifier.cpp
modified

Files Changed

  • dom/cookiestore/CookieStoreNotifier.cpp
  • dom/cookiestore/CookieStoreNotifier.h
diff --git a/dom/cookiestore/CookieStoreNotifier.cpp b/dom/cookiestore/CookieStoreNotifier.cpp
index 73f2b3e9617..1a6561fea35 100644
--- a/dom/cookiestore/CookieStoreNotifier.cpp
+++ b/dom/cookiestore/CookieStoreNotifier.cpp
@@ -47,13 +47,18 @@ already_AddRefed<CookieStoreNotifier> CookieStoreNotifier::Create(
     return nullptr;
   }
 
+  nsCString host;
+  if (NS_WARN_IF(NS_FAILED(principal->GetAsciiHost(host))) || host.IsEmpty()) {
+    return nullptr;
+  }
+
   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
   if (NS_WARN_IF(!os)) {
     return nullptr;
   }
 
   RefPtr<CookieStoreNotifier> notifier = new CookieStoreNotifier(
-      aCookieStore, baseDomain, principal->OriginAttributesRef());
+      aCookieStore, baseDomain, host, principal->OriginAttributesRef());
 
   nsresult rv =
       os->AddObserver(notifier,
@@ -68,9 +73,10 @@ already_AddRefed<CookieStoreNotifier> CookieStoreNotifier::Create(
 
 CookieStoreNotifier::CookieStoreNotifier(
     CookieStore* aCookieStore, const nsACString& aBaseDomain,
-    const OriginAttributes& aOriginAttributes)
+    const nsACString& aHost, const OriginAttributes& aOriginAttributes)
     : mCookieStore(aCookieStore),
       mBaseDomain(aBaseDomain),
+      mHost(aHost),
       mOriginAttributes(aOriginAttributes) {
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aCookieStore);
@@ -129,6 +135,10 @@ CookieStoreNotifier::Observe(nsISupports* aSubject, const char* aTopic,
     return NS_OK;
   }
 
+  if (!net::CookieCommons::DomainMatches(net::Cookie::Cast(cookie), mHost)) {
+    return NS_OK;
+  }
+
   bool isHttpOnly;
   rv = cookie->GetIsHttpOnly(&isHttpOnly);
   if (NS_WARN_IF(NS_FAILED(rv))) {
diff --git a/dom/cookiestore/CookieStoreNotifier.h b/dom/cookiestore/CookieStoreNotifier.h
index 7eefee65b35..b064293fc3e 100644
--- a/dom/cookiestore/CookieStoreNotifier.h
+++ b/dom/cookiestore/CookieStoreNotifier.h
@@ -30,6 +30,7 @@ class CookieStoreNotifier final : public nsIObserver {
 
  private:
   CookieStoreNotifier(CookieStore* aCookieStore, const nsACString& aBaseDomain,
+                      const nsACString& aHost,
                       const OriginAttributes& aOriginAttributes);
   ~CookieStoreNotifier();
 
@@ -39,6 +40,7 @@ class CookieStoreNotifier final : public nsIObserver {
   CookieStore* mCookieStore;
 
   nsCString mBaseDomain;
+  nsCString mHost;
   OriginAttributes mOriginAttributes;
 
   nsTArray<RefPtr<Event>> mDelayedDOMEvents;
Loading diff…