Firefox · DOM
CVE-2026-6755
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/PostMessageEvent.cpp |
modified |
Files Changed
dom/base/PostMessageEvent.cpp
Patch
diff --git a/dom/base/PostMessageEvent.cpp b/dom/base/PostMessageEvent.cpp
index 952b9e93958..b5ed6a79158 100644
--- a/dom/base/PostMessageEvent.cpp
+++ b/dom/base/PostMessageEvent.cpp
@@ -14,6 +14,7 @@
#include "mozilla/dom/MessageEventBinding.h"
#include "mozilla/dom/MessagePort.h"
#include "mozilla/dom/RootedDictionary.h"
+#include "mozilla/dom/WindowContext.h"
#include "mozilla/BasePrincipal.h"
#include "mozilla/EventDispatcher.h"
#include "mozilla/StaticPrefs_dom.h"
@@ -52,6 +53,13 @@ PostMessageEvent::~PostMessageEvent() = default;
// TODO: Convert this to MOZ_CAN_RUN_SCRIPT (bug 1415230, bug 1535398)
MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP PostMessageEvent::Run() {
+ if (mCallerWindowID) {
+ RefPtr<WindowContext> wc = WindowContext::GetById(mCallerWindowID);
+ if (!wc || !wc->IsCurrent()) {
+ mSource = nullptr;
+ }
+ }
+
// Note: We don't init this AutoJSAPI with targetWindow, because we do not
// want exceptions during message deserialization to trigger error events on
// targetWindow.
Loading diff…
References
On This Page