Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the DOM: Security component
ComponentDOM
Bug ClassLogic Error
Tracker2012984
Fix commit22deadcb9a40 (firefox) +6/-4
CISA KEVNot listed
CreditedD. Santos
Disclosed2026-02-24

Changed Functions

FunctionChangeNotes
if
dom/fetch/FetchService.cpp
modified

Files Changed

  • dom/fetch/FetchParent.cpp
  • dom/fetch/FetchService.cpp
  • dom/fetch/FetchService.h
diff --git a/dom/fetch/FetchParent.cpp b/dom/fetch/FetchParent.cpp
index d7791cebac1..ef908084a56 100644
--- a/dom/fetch/FetchParent.cpp
+++ b/dom/fetch/FetchParent.cpp
@@ -176,7 +176,7 @@ IPCResult FetchParent::RecvFetchOp(FetchOpArgs&& aArgs) {
       self->mResponsePromises =
           fetchService->Fetch(AsVariant(FetchService::WorkerFetchArgs(
               {self->mRequest.clonePtr(), self->mPrincipalInfo,
-               self->mWorkerScript, self->mClientInfo, self->mController,
+               self->mWorkerScript, *self->mClientInfo, self->mController,
                self->mCookieJarSettings, self->mNeedOnDataAvailable,
                self->mCSPEventListener, self->mAssociatedBrowsingContextID,
                self->mBackgroundEventTarget, self->mID,
@@ -189,6 +189,7 @@ IPCResult FetchParent::RecvFetchOp(FetchOpArgs&& aArgs) {
           fetchService->Fetch(AsVariant(FetchService::MainThreadFetchArgs({
               self->mRequest.clonePtr(),
               self->mPrincipalInfo,
+              *self->mClientInfo,
               self->mCookieJarSettings,
               self->mNeedOnDataAvailable,
               self->mCSPEventListener,
diff --git a/dom/fetch/FetchService.cpp b/dom/fetch/FetchService.cpp
index 13ad1f24ab1..14c8fb1a265 100644
--- a/dom/fetch/FetchService.cpp
+++ b/dom/fetch/FetchService.cpp
@@ -270,8 +270,7 @@ RefPtr<FetchServicePromises> FetchService::FetchInstance::Fetch() {
   if (mArgsType == FetchArgsType::WorkerFetch) {
     auto& args = mArgs.as<WorkerFetchArgs>();
     mFetchDriver->SetWorkerScript(args.mWorkerScript);
-    MOZ_ASSERT(args.mClientInfo.isSome());
-    mFetchDriver->SetClientInfo(args.mClientInfo.ref());
+    mFetchDriver->SetClientInfo(args.mClientInfo);
     mFetchDriver->SetController(args.mController);
     if (args.mCSPEventListener) {
       mFetchDriver->SetCSPEventListener(args.mCSPEventListener);
@@ -284,6 +283,7 @@ RefPtr<FetchServicePromises> FetchService::FetchInstance::Fetch() {
 
   if (mArgsType == FetchArgsType::MainThreadFetch) {
     auto& args = mArgs.as<MainThreadFetchArgs>();
+    mFetchDriver->SetClientInfo(args.mClientInfo);
     mFetchDriver->SetAssociatedBrowsingContextID(
         args.mAssociatedBrowsingContextID);
     mFetchDriver->SetIsThirdPartyContext(Some(args.mIsThirdPartyContext));
diff --git a/dom/fetch/FetchService.h b/dom/fetch/FetchService.h
index 00dc76f6dae..c1c7edeea9a 100644
--- a/dom/fetch/FetchService.h
+++ b/dom/fetch/FetchService.h
@@ -108,7 +108,7 @@ class FetchService final : public nsIObserver {
     SafeRefPtr<InternalRequest> mRequest;
     mozilla::ipc::PrincipalInfo mPrincipalInfo;
     nsCString mWorkerScript;
-    Maybe<ClientInfo> mClientInfo;
+    ClientInfo mClientInfo;
     Maybe<ServiceWorkerDescriptor> mController;
     Maybe<net::CookieJarSettingsArgs> mCookieJarSettings;
     bool mNeedOnDataAvailable;
@@ -131,6 +131,7 @@ class FetchService final : public nsIObserver {
   struct MainThreadFetchArgs {
     SafeRefPtr<InternalRequest> mRequest;
     mozilla::ipc::PrincipalInfo mPrincipalInfo;
+    ClientInfo mClientInfo;
     Maybe<net::CookieJarSettingsArgs> mCookieJarSettings;
     bool mNeedOnDataAvailable;
     nsCOMPtr<nsICSPEventListener> mCSPEventListener;
Loading diff…