Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionSpoofing issue in Firefox for Android
ComponentCore
Bug ClassLogic Error
Tracker2020253
Fix commit594f5a94549b (firefox) +36/-1
CISA KEVNot listed
CreditedKhiem Tran
Disclosed2026-07-21

Changed Functions

FunctionChangeNotes
receiveMessage
mobile/shared/actors/GeckoViewPromptParent.sys.mjs
modified
if
mobile/shared/actors/GeckoViewPromptParent.sys.mjs
modified
unblockRedirect
mobile/shared/actors/GeckoViewPromptParent.sys.mjs
modified
if
mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs
modified

Files Changed

  • mobile/shared/actors/GeckoViewPromptParent.sys.mjs
  • mobile/shared/actors/moz.build
  • mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs
  • mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
diff --git a/mobile/shared/actors/GeckoViewPromptParent.sys.mjs b/mobile/shared/actors/GeckoViewPromptParent.sys.mjs
new file mode 100644
index 00000000000..9cc3eb684ad
--- /dev/null
+++ b/mobile/shared/actors/GeckoViewPromptParent.sys.mjs
@@ -0,0 +1,28 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+import { GeckoViewActorParent } from "resource://gre/modules/GeckoViewActorParent.sys.mjs";
+
+export class GeckoViewPromptParent extends GeckoViewActorParent {
+  receiveMessage({ name, data }) {
+    if (name === "GeckoView:UnblockRedirect") {
+      this.unblockRedirect(data.redirectURISpec);
+      return null;
+    }
+
+    return super.receiveMessage({ name, data });
+  }
+
+  unblockRedirect(aRedirectURISpec) {
+    const sourceWG = this.browsingContext.currentWindowGlobal;
+    if (!sourceWG) {
+      return;
+    }
+
+    const uri = Services.io.newURI(aRedirectURISpec);
+    this.browsingContext.top.loadURI(uri, {
+      triggeringPrincipal: sourceWG.documentPrincipal,
+    });
+  }
+}
diff --git a/mobile/shared/actors/moz.build b/mobile/shared/actors/moz.build
index f9572acc3d1..56ed7942f65 100644
--- a/mobile/shared/actors/moz.build
+++ b/mobile/shared/actors/moz.build
@@ -23,6 +23,7 @@ FINAL_TARGET_FILES.actors += [
     "GeckoViewPromptChild.sys.mjs",
     "GeckoViewPrompterChild.sys.mjs",
     "GeckoViewPrompterParent.sys.mjs",
+    "GeckoViewPromptParent.sys.mjs",
     "GeckoViewPushParent.sys.mjs",
     "GeckoViewSettingsChild.sys.mjs",
     "LoadURIDelegateChild.sys.mjs",
diff --git a/mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs b/mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs
index e195b48ca75..82622affebf 100644
--- a/mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs
+++ b/mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs
@@ -345,7 +345,10 @@ export class PromptFactory {
       },
       ({ response }) => {
         if (response && dwi) {
-          dwi.top.location.href = redirectURISpec;
+          const actor = dwi.windowGlobalChild.getActor("GeckoViewPrompt");
+          actor.sendAsyncMessage("GeckoView:UnblockRedirect", {
+            redirectURISpec,
+          });
         }
       }
     );
diff --git a/mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs b/mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
index 6996d0f77a2..9567abab0db 100644
--- a/mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
+++ b/mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
@@ -68,6 +68,9 @@ const JSWINDOWACTORS = {
     includeChrome: true,
   },
   GeckoViewPrompt: {
+    parent: {
+      esModuleURI: "resource:///actors/GeckoViewPromptParent.sys.mjs",
+    },
     child: {
       esModuleURI: "resource:///actors/GeckoViewPromptChild.sys.mjs",
       events: {
Loading diff…