Firefox · DOM
CVE-2026-6760
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/cookiestore/CookieStoreParent.cppdom/cookiestore/CookieStoreParent.h
Patch
diff --git a/dom/cookiestore/CookieStoreParent.cpp b/dom/cookiestore/CookieStoreParent.cpp
index b49e4f690b7..fcc2bb7d314 100644
--- a/dom/cookiestore/CookieStoreParent.cpp
+++ b/dom/cookiestore/CookieStoreParent.cpp
@@ -82,20 +82,24 @@ mozilla::ipc::IPCResult CookieStoreParent::RecvGetRequest(
const bool& aOnlyFirstMatch, GetRequestResolver&& aResolver) {
AssertIsOnBackgroundThread();
- InvokeAsync(GetMainThreadSerialEventTarget(), __func__,
- [self = RefPtr(this), uri = aCookieURI.get(), aOriginAttributes,
- aPartitionedOriginAttributes, aThirdPartyContext,
- aPartitionForeign, aUsingStorageAccess, aIsOn3PCBExceptionList,
- aMatchName, aName, aPath, aOnlyFirstMatch]() {
- CopyableTArray<CookieStruct> results;
- self->GetRequestOnMainThread(
- uri, aOriginAttributes, aPartitionedOriginAttributes,
- aThirdPartyContext, aPartitionForeign, aUsingStorageAccess,
- aIsOn3PCBExceptionList, aMatchName, aName, aPath,
- aOnlyFirstMatch, results);
- return GetRequestPromise::CreateAndResolve(std::move(results),
- __func__);
- })
+ RefPtr<ThreadsafeContentParentHandle> parent =
+ BackgroundParent::GetContentParentHandle(Manager());
+
+ InvokeAsync(
+ GetMainThreadSerialEventTarget(), __func__,
+ [self = RefPtr(this), parent = RefPtr(parent), uri = aCookieURI.get(),
+ aOriginAttributes, aPartitionedOriginAttributes, aThirdPartyContext,
+ aPartitionForeign, aUsingStorageAccess, aIsOn3PCBExceptionList,
+ aMatchName, aName, aPath, aOnlyFirstMatch]() {
+ CopyableTArray<CookieStruct> results;
+ self->GetRequestOnMainThread(
+ parent, uri, aOriginAttributes, aPartitionedOriginAttributes,
+ aThirdPartyContext, aPartitionForeign, aUsingStorageAccess,
+ aIsOn3PCBExceptionList, aMatchName, aName, aPath, aOnlyFirstMatch,
+ results);
+ return GetRequestPromise::CreateAndResolve(std::move(results),
+ __func__);
+ })
->Then(GetCurrentSerialEventTarget(), __func__,
[aResolver = std::move(aResolver)](
const GetRequestPromise::ResolveOrRejectValue& aResult) {
@@ -273,7 +277,8 @@ mozilla::ipc::IPCResult CookieStoreParent::RecvClose() {
}
void CookieStoreParent::GetRequestOnMainThread(
- const RefPtr<nsIURI> aCookieURI, const OriginAttributes& aOriginAttributes,
+ ThreadsafeContentParentHandle* aParent, const RefPtr<nsIURI> aCookieURI,
+ const OriginAttributes& aOriginAttributes,
const Maybe<OriginAttributes>& aPartitionedOriginAttributes,
bool aThirdPartyContext, bool aPartitionForeign, bool aUsingStorageAccess,
bool aIsOn3PCBExceptionList, bool aMatchName, const nsAString& aName,
@@ -297,6 +302,10 @@ void CookieStoreParent::GetRequestOnMainThread(
return;
}
+ if (!CheckContentProcessSecurity(aParent, baseDomain, aOriginAttributes)) {
+ return;
+ }
+
nsAutoCString hostName;
rv = nsContentUtils::GetHostOrIPv6WithBrackets(aCookieURI, hostName);
if (NS_FAILED(rv)) {
diff --git a/dom/cookiestore/CookieStoreParent.h b/dom/cookiestore/CookieStoreParent.h
index 88be368a310..54cf6aa96ce 100644
--- a/dom/cookiestore/CookieStoreParent.h
+++ b/dom/cookiestore/CookieStoreParent.h
@@ -70,7 +70,7 @@ class CookieStoreParent final : public PCookieStoreParent {
mozilla::ipc::IPCResult RecvClose();
void GetRequestOnMainThread(
- const RefPtr<nsIURI> aCookieURI,
+ ThreadsafeContentParentHandle* aParent, const RefPtr<nsIURI> aCookieURI,
const OriginAttributes& aOriginAttributes,
const Maybe<OriginAttributes>& aPartitionedOriginAttributes,
bool aThirdPartyContext, bool aPartitionForeign, bool aUsingStorageAccess,
Loading diff…
References
On This Page