Firefox · DOM
CVE-2026-74953
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/ipc/WindowGlobalParent.cpp
Patch
diff --git a/dom/ipc/WindowGlobalParent.cpp b/dom/ipc/WindowGlobalParent.cpp
index 891ad30aba6..b2b38aecb1e 100644
--- a/dom/ipc/WindowGlobalParent.cpp
+++ b/dom/ipc/WindowGlobalParent.cpp
@@ -1823,6 +1823,10 @@ IPCResult WindowGlobalParent::RecvSetCookies(
NS_ENSURE_TRUE(csParent, IPC_OK());
auto* cs = static_cast<net::CookieServiceParent*>(csParent);
+ if (!cs->ContentProcessHasCookie(aBaseDomain, aOriginAttributes)) {
+ return IPC_FAIL(this, "Invalid set-cookie request from content process");
+ }
+
return cs->SetCookies(aBaseDomain, aOriginAttributes, aHost, aIsThirdParty,
aCookies, GetBrowsingContext());
}
Loading diff…
References
On This Page