Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionPrivilege escalation in the Data Loss Prevention component
ComponentDOM
Bug ClassLogic Error
Tracker2052565
Fix commitcb447ed89ad8 (firefox) +15/-1
CISA KEVNot listed
CreditedBrian Carpenter
Disclosed2026-07-21

Changed Functions

FunctionChangeNotes
if
dom/ipc/ContentParent.cpp
modified

Files Changed

  • dom/ipc/ContentParent.cpp
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index a35f7e4e082..3538da8e512 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -3343,6 +3343,11 @@ nsresult ContentParent::GetClipboardDataInternal(
     return NS_ERROR_INVALID_ARG;
   }
 
+  RefPtr<WindowGlobalParent> window = aRequestingWindowContext.get_canonical();
+  if (window && window->GetContentParent() != this) {
+    return NS_ERROR_ILLEGAL_VALUE;
+  }
+
   nsresult rv;
   nsCOMPtr<nsIClipboard> clipboard(do_GetService(kCClipboardCID, &rv));
   if (NS_FAILED(rv)) {
@@ -3357,7 +3362,6 @@ nsresult ContentParent::GetClipboardDataInternal(
   }
 
   nsCOMPtr<nsITransferable> transferable = result.unwrap();
-  RefPtr<WindowGlobalParent> window = aRequestingWindowContext.get_canonical();
 
   rv = aFunction(clipboard, transferable, aWhichClipboard, window);
   if (NS_FAILED(rv)) {
@@ -3390,6 +3394,11 @@ mozilla::ipc::IPCResult ContentParent::RecvGetClipboard(
     return IPC_FAIL(this, "passed null window to RecvGetClipboard()");
   }
 
+  if (rv == NS_ERROR_ILLEGAL_VALUE) {
+    return IPC_FAIL(
+        this, "attempt to paste into WindowContext loaded in another process");
+  }
+
   return IPC_OK();
 }
 
@@ -3413,6 +3422,11 @@ mozilla::ipc::IPCResult ContentParent::RecvGetClipboardDataIfSmallerThan(
         this, "passed null window to RecvGetClipboardDataIfSmallerThan()");
   }
 
+  if (rv == NS_ERROR_ILLEGAL_VALUE) {
+    return IPC_FAIL(
+        this, "attempt to paste into WindowContext loaded in another process");
+  }
+
   aResolver(std::move(result));
   return IPC_OK();
 }
Loading diff…