Firefox · DOM
CVE-2026-16401
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/ipc/ContentParent.cpp |
modified |
Files Changed
dom/ipc/ContentParent.cpp
Patch
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index a35f7e4e082..3538da8e512 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -3343,6 +3343,11 @@ nsresult ContentParent::GetClipboardDataInternal(
return NS_ERROR_INVALID_ARG;
}
+ RefPtr<WindowGlobalParent> window = aRequestingWindowContext.get_canonical();
+ if (window && window->GetContentParent() != this) {
+ return NS_ERROR_ILLEGAL_VALUE;
+ }
+
nsresult rv;
nsCOMPtr<nsIClipboard> clipboard(do_GetService(kCClipboardCID, &rv));
if (NS_FAILED(rv)) {
@@ -3357,7 +3362,6 @@ nsresult ContentParent::GetClipboardDataInternal(
}
nsCOMPtr<nsITransferable> transferable = result.unwrap();
- RefPtr<WindowGlobalParent> window = aRequestingWindowContext.get_canonical();
rv = aFunction(clipboard, transferable, aWhichClipboard, window);
if (NS_FAILED(rv)) {
@@ -3390,6 +3394,11 @@ mozilla::ipc::IPCResult ContentParent::RecvGetClipboard(
return IPC_FAIL(this, "passed null window to RecvGetClipboard()");
}
+ if (rv == NS_ERROR_ILLEGAL_VALUE) {
+ return IPC_FAIL(
+ this, "attempt to paste into WindowContext loaded in another process");
+ }
+
return IPC_OK();
}
@@ -3413,6 +3422,11 @@ mozilla::ipc::IPCResult ContentParent::RecvGetClipboardDataIfSmallerThan(
this, "passed null window to RecvGetClipboardDataIfSmallerThan()");
}
+ if (rv == NS_ERROR_ILLEGAL_VALUE) {
+ return IPC_FAIL(
+ this, "attempt to paste into WindowContext loaded in another process");
+ }
+
aResolver(std::move(result));
return IPC_OK();
}
Loading diff…
References
On This Page