Firefox · Core
CVE-2026-4692
Sandbox Escape in Core
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
docshell/base/BrowsingContext.cppdocshell/base/BrowsingContext.h
Patch
diff --git a/docshell/base/BrowsingContext.cpp b/docshell/base/BrowsingContext.cpp
index 7c603b07e5f..fbe026aea0e 100644
--- a/docshell/base/BrowsingContext.cpp
+++ b/docshell/base/BrowsingContext.cpp
@@ -3325,6 +3325,11 @@ void BrowsingContext::DidSet(FieldIndex<IDX_ExplicitActive>,
ActivenessChanged(isActive);
}
+bool BrowsingContext::CanSet(FieldIndex<IDX_InRDMPane>, const bool&,
+ ContentParent* aSource) {
+ return XRE_IsParentProcess() && IsTop() && !aSource;
+}
+
void BrowsingContext::DidSet(FieldIndex<IDX_InRDMPane>, bool aOldValue) {
MOZ_ASSERT(IsTop(),
"Should only set InRDMPane in the top-level browsing context");
diff --git a/docshell/base/BrowsingContext.h b/docshell/base/BrowsingContext.h
index 11f70e98e4f..2920382adc0 100644
--- a/docshell/base/BrowsingContext.h
+++ b/docshell/base/BrowsingContext.h
@@ -1328,6 +1328,7 @@ class BrowsingContext : public nsILoadContext, public nsWrapperCache {
return IsTop();
}
+ bool CanSet(FieldIndex<IDX_InRDMPane>, const bool&, ContentParent* aSource);
void DidSet(FieldIndex<IDX_InRDMPane>, bool aOldValue);
void DidSet(FieldIndex<IDX_HasOrientationOverride>, bool aOldValue);
MOZ_CAN_RUN_SCRIPT_BOUNDARY void DidSet(FieldIndex<IDX_ForceDesktopViewport>,
Loading diff…
References
On This Page