Firefox · DOM
CVE-2026-74967
Cross Origin in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/media/mediaelement/HTMLMediaElement.cpp |
modified |
Files Changed
dom/media/mediaelement/HTMLMediaElement.cppdom/media/mediaelement/HTMLMediaElement.h
Patch
diff --git a/dom/media/mediaelement/HTMLMediaElement.cpp b/dom/media/mediaelement/HTMLMediaElement.cpp
index 5db7e05ccff..7272c99c7d0 100644
--- a/dom/media/mediaelement/HTMLMediaElement.cpp
+++ b/dom/media/mediaelement/HTMLMediaElement.cpp
@@ -2575,6 +2575,18 @@ nsresult HTMLMediaElement::OnChannelRedirect(nsIChannel* aChannel,
nsIChannel* aNewChannel,
uint32_t aFlags) {
MOZ_ASSERT(mChannelLoader);
+ if (aNewChannel) {
+ nsCOMPtr<nsIURI> oldURI;
+ if (aChannel) {
+ aChannel->GetURI(getter_AddRefs(oldURI));
+ }
+ aNewChannel->GetURI(getter_AddRefs(mLoadingSrcFinalURI));
+ LOG(LogLevel::Debug,
+ ("{} OnChannelRedirect: from {} to {}", fmt::ptr(this),
+ oldURI ? oldURI->GetSpecOrDefault().get() : "null",
+ mLoadingSrcFinalURI ? mLoadingSrcFinalURI->GetSpecOrDefault().get()
+ : "null"));
+ }
return mChannelLoader->Redirect(aChannel, aNewChannel, aFlags);
}
@@ -2617,6 +2629,8 @@ void HTMLMediaElement::AbortExistingLoads() {
mChannelLoader = nullptr;
}
+ mLoadingSrcFinalURI = nullptr;
+
bool fireTimeUpdate = false;
if (mDecoder) {
@@ -2731,12 +2745,12 @@ void HTMLMediaElement::NoSupportedMediaSourceError(
bool isSameOriginLoad = false;
nsresult rv = NS_ERROR_NOT_AVAILABLE;
- if (mSrcAttrTriggeringPrincipal && mLoadingSrc) {
- rv = mSrcAttrTriggeringPrincipal->IsSameOrigin(mLoadingSrc,
- &isSameOriginLoad);
+ if (mLoadingSrcTriggeringPrincipal && mLoadingSrcFinalURI) {
+ rv = mLoadingSrcTriggeringPrincipal->IsSameOrigin(mLoadingSrcFinalURI,
+ &isSameOriginLoad);
}
- if (NS_SUCCEEDED(rv) && !isSameOriginLoad) {
+ if (NS_FAILED(rv) || !isSameOriginLoad) {
// aErrorDetails can include sensitive details like MimeType or HTTP Status
// Code. In case we're loading a 3rd party resource we should not leak this
// and pass a Generic Error Message
@@ -2968,6 +2982,7 @@ void HTMLMediaElement::SelectResource(
} else {
mLoadingSrc = nullptr;
}
+ mLoadingSrcFinalURI = mLoadingSrc;
mLoadingSrcTriggeringPrincipal = mSrcAttrTriggeringPrincipal;
DDLOG(DDLogCategory::Property, "loading_src",
nsCString(NS_ConvertUTF16toUTF8(src)));
@@ -3255,6 +3270,7 @@ void HTMLMediaElement::LoadFromSourceChildren(
RemoveMediaElementFromURITable();
mLoadingSrc = uri;
+ mLoadingSrcFinalURI = mLoadingSrc;
mLoadingSrcTriggeringPrincipal = child->GetSrcTriggeringPrincipal();
DDLOG(DDLogCategory::Property, "loading_src",
nsCString(NS_ConvertUTF16toUTF8(src)));
diff --git a/dom/media/mediaelement/HTMLMediaElement.h b/dom/media/mediaelement/HTMLMediaElement.h
index e0e0d3658af..163b2151b23 100644
--- a/dom/media/mediaelement/HTMLMediaElement.h
+++ b/dom/media/mediaelement/HTMLMediaElement.h
@@ -1646,6 +1646,12 @@ class HTMLMediaElement : public nsGenericHTMLElement,
// redirects etc.
nsCOMPtr<nsIURI> mLoadingSrc;
+ // The URI of the resource actually loaded. Starts equal to mLoadingSrc and
+ // is updated to the post-redirect URI on each redirect. Used to decide
+ // cross-origin load-error redaction; null means we have no captured URI, and
+ // is treated as cross-origin.
+ nsCOMPtr<nsIURI> mLoadingSrcFinalURI;
+
// The triggering principal for the current source.
nsCOMPtr<nsIPrincipal> mLoadingSrcTriggeringPrincipal;
Loading diff…
References
On This Page