Firefox · Networking
CVE-2026-74939
Logic Error in Networking
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdocshell/base/nsDocShellLoadState.cpp |
modified |
Files Changed
docshell/base/nsDocShellLoadState.cppnetwerk/ipc/DocumentLoadListener.cpp
Patch
diff --git a/docshell/base/nsDocShellLoadState.cpp b/docshell/base/nsDocShellLoadState.cpp
index ea31776de66..12b11965ab4 100644
--- a/docshell/base/nsDocShellLoadState.cpp
+++ b/docshell/base/nsDocShellLoadState.cpp
@@ -162,10 +162,16 @@ nsDocShellLoadState::nsDocShellLoadState(
return;
}
- if (mURI->SchemeIs("javascript") &&
- mTriggeringRemoteType != NOT_REMOTE_TYPE) {
- aActor->FatalError("Illegal cross-process javascript: load attempt");
- return;
+ if (mTriggeringRemoteType != NOT_REMOTE_TYPE) {
+ if (mURI->SchemeIs("javascript")) {
+ aActor->FatalError("Illegal cross-process javascript: load attempt");
+ return;
+ }
+
+ if (mRemoteTypeOverride.isSome()) {
+ aActor->FatalError("RemoteTypeOverride can only be set by parent");
+ return;
+ }
}
if (!ValidatePrincipalCouldPotentiallyBeLoadedBy(
diff --git a/netwerk/ipc/DocumentLoadListener.cpp b/netwerk/ipc/DocumentLoadListener.cpp
index 9005281a3ae..845b82753d7 100644
--- a/netwerk/ipc/DocumentLoadListener.cpp
+++ b/netwerk/ipc/DocumentLoadListener.cpp
@@ -775,7 +775,9 @@ auto DocumentLoadListener::Open(nsDocShellLoadState* aLoadState,
if (aLoadState->GetRemoteTypeOverride()) {
if (!mIsDocumentLoad || !NS_IsAboutBlank(aLoadState->URI()) ||
- !loadingContext->IsTopContent()) {
+ !loadingContext->IsTopContent() ||
+ aLoadState->GetEffectiveTriggeringRemoteType() != NOT_REMOTE_TYPE ||
+ aLoadState->LoadIsFromSessionHistory()) {
LOG(
("DocumentLoadListener::Open with invalid remoteTypeOverride "
"[this=%p]",
Loading diff…
References
On This Page