Firefox · Networking
CVE-2026-16380
Logic Error in Networking
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- Local Network Access (LNA)
- a mechanism that gates requests reaching local/private network endpoints so untrusted web content cannot freely probe them.
- Triggering principal
- the security principal (
nsIPrincipal) representing the origin that initiated the load, carried onmLoadInfo. - Potentially trustworthy origin
- an origin considered secure (e.g. HTTPS or
localhost), reported bynsIPrincipal::GetIsOriginPotentiallyTrustworthy. - Same-origin exemption
- a shortcut in
UpdateLocalNetworkAccessPermissionsthat grants LNA permission when the request targets the triggering principal’s own origin.
Root Cause Analysis
In nsHttpChannel::UpdateLocalNetworkAccessPermissions, a same-origin request (where IsSameOrigin succeeds, the target is not rerouted elsewhere) was unconditionally granted LNAPermission::Granted and returned early, before the later insecure-context blocking check could run. The violated invariant is that LNA access should only be exempted for secure (potentially trustworthy) contexts, but the same-origin fast path applied to insecure origins too. Because the early return bypassed the network_lna_block_insecure_contexts gate, an insecure (e.g. plain HTTP) page loading its own origin could reach local network resources despite the mitigation.
The fix computes triggeringPrincipalIsPotentiallyTrustworthy up front and adds it as a condition on the same-origin grant, so insecure same-origin requests fall through to the standard blocking logic. It also refactors the insecure-context block to reuse that same variable, keeping the two checks consistent.
The result is that the same-origin exemption can no longer be used to bypass the insecure-context LNA mitigation.
Key insight
The single mistake was granting the LNA same-origin exemption without first confirming the triggering principal was in a secure context, letting the exemption’s early return skip the insecure-context block; the fix conditions the grant on
triggeringPrincipalIsPotentiallyTrustworthy so insecure origins no longer qualify.Attack Path
- Serve an insecure page An attacker hosts content over plain HTTP (a non-potentially-trustworthy origin).
- Issue a same-origin request
The page triggers a request that
IsSameOrigintreats as targeting its own origin and is not rerouted elsewhere. - Hit the exemption fast path
The pre-fix code sets
userPerms = LNAPermission::Grantedand returns early, before the insecure-context check. - Bypass the mitigation
The
network_lna_block_insecure_contextsblock is never reached, so the LNA denial that should apply to insecure contexts is skipped. - Reach local network endpoints The request proceeds with granted LNA permission, defeating the intended insecure-context restriction.
Impact Assessment
An attacker controlling an insecure (HTTP) origin gains the ability to bypass the Local Network Access mitigation for same-origin requests, reaching local/private network resources that the insecure-context block was meant to deny. This occurs in the networking path of the parent/content process via
nsHttpChannel, and requires the mitigation pref network_lna_block_insecure_contexts to be enabled and the victim to load attacker-influenced insecure content. It is a mitigation bypass of moderate severity, not a direct memory-safety or code-execution flaw.Files Changed
netwerk/protocol/http/nsHttpChannel.cpp
Audit Directions
- Early-return exemptions before security gatesAudit permission logic where a fast-path grant
returns before a later blocking check, since the shortcut can silently bypass the mitigation. - Same-origin shortcuts and trust levelVerify that same-origin or same-site fast paths also enforce secure-context / potentially-trustworthy requirements rather than assuming same-origin implies safe.
- Insecure-context mitigationsCheck every code path guarded by
network_lna_block_insecure_contexts(and similar insecure-context prefs) to ensure no alternate branch reaches the resource without consultingGetIsOriginPotentiallyTrustworthy.
Patch
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index e1fdf672424..b19a9c20d3e 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -2073,10 +2073,14 @@ LNAPermission nsHttpChannel::UpdateLocalNetworkAccessPermissions(
mConnectionInfo && !mConnectionInfo->GetRoutedHost().IsEmpty() &&
(!mConnectionInfo->GetRoutedHost().Equals(mConnectionInfo->GetOrigin()) ||
mConnectionInfo->RoutedPort() != mConnectionInfo->OriginPort());
+ // This exemption (same origin) should apply only to secure contexts.
+ const bool triggeringPrincipalIsPotentiallyTrustworthy =
+ mLoadInfo->TriggeringPrincipal()->GetIsOriginPotentiallyTrustworthy();
bool isSameOrigin = false;
nsresult rv =
mLoadInfo->TriggeringPrincipal()->IsSameOrigin(mURI, &isSameOrigin);
- if (NS_SUCCEEDED(rv) && isSameOrigin && !reroutedElsewhere) {
+ if (NS_SUCCEEDED(rv) && isSameOrigin && !reroutedElsewhere &&
+ triggeringPrincipalIsPotentiallyTrustworthy) {
userPerms = LNAPermission::Granted;
return userPerms;
}
@@ -2118,18 +2122,14 @@ LNAPermission nsHttpChannel::UpdateLocalNetworkAccessPermissions(
}
// Check if we should block LNA requests from insecure contexts
- if (StaticPrefs::network_lna_block_insecure_contexts()) {
- nsCOMPtr<nsIPrincipal> triggeringPrincipal =
- mLoadInfo->TriggeringPrincipal();
- if (triggeringPrincipal &&
- !triggeringPrincipal->GetIsOriginPotentiallyTrustworthy()) {
- LOG(
- ("nsHttpChannel::UpdateLocalNetworkAccessPermissions [this=%p] "
- "blocking LNA request from insecure context\n",
- this));
- userPerms = LNAPermission::Denied;
- return userPerms;
- }
+ if (StaticPrefs::network_lna_block_insecure_contexts() &&
+ !triggeringPrincipalIsPotentiallyTrustworthy) {
+ LOG(
+ ("nsHttpChannel::UpdateLocalNetworkAccessPermissions [this=%p] "
+ "blocking LNA request from insecure context\n",
+ this));
+ userPerms = LNAPermission::Denied;
+ return userPerms;
}
// Step 3
Loading diff…
References
On This Page