Low firefox Cross Origin 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionSame-origin policy bypass in the Networking: JAR component
ComponentCore
Bug ClassCross Origin
Tracker2008426
Fix commit33e7b7721014 (firefox) +10/-0
CISA KEVNot listed
CreditedSurya Dev Singh
Disclosed2026-02-24

Files Changed

  • uriloader/base/nsURILoader.cpp
diff --git a/uriloader/base/nsURILoader.cpp b/uriloader/base/nsURILoader.cpp
index 58843d1d8cc..47263b2d045 100644
--- a/uriloader/base/nsURILoader.cpp
+++ b/uriloader/base/nsURILoader.cpp
@@ -17,6 +17,7 @@
 #include "nsIInterfaceRequestor.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIInputStream.h"
+#include "nsIJARChannel.h"
 #include "nsIStreamConverterService.h"
 #include "nsIWeakReferenceUtils.h"
 #include "nsIHttpChannel.h"
@@ -690,6 +691,15 @@ nsresult nsDocumentOpenInfo::TryStreamConversion(nsIChannel* aChannel) {
     srcContentType.AssignLiteral(UNKNOWN_CONTENT_TYPE);
   }
 
+  // If this is an unknown content type loaded from a JAR file
+  // don't attempt to sniff it.
+  if (srcContentType.EqualsLiteral(UNKNOWN_CONTENT_TYPE)) {
+    if (nsCOMPtr<nsIJARChannel> jar = do_QueryInterface(aChannel)) {
+      m_targetStreamListener = nullptr;
+      return NS_ERROR_NOT_AVAILABLE;
+    }
+  }
+
   nsresult rv =
       ConvertData(aChannel, m_contentListener, srcContentType, anyType);
   if (NS_FAILED(rv)) {
Loading diff…