Firefox · DOM
CVE-2026-74972
Logic Error in DOM
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/push/PushManager.cpp |
modified |
Files Changed
dom/push/PushManager.cpptesting/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini
Patch
diff --git a/dom/push/PushManager.cpp b/dom/push/PushManager.cpp
index 3deff5ec077..caba571b0c1 100644
--- a/dom/push/PushManager.cpp
+++ b/dom/push/PushManager.cpp
@@ -215,6 +215,7 @@ class GetSubscriptionRunnable final : public Runnable {
AssertIsOnMainThread();
nsCOMPtr<nsIPrincipal> principal;
+ nsCOMPtr<nsIPrincipal> effectiveStoragePrincipal;
{
// Bug 1228723: If permission is revoked or an error occurs, the
@@ -226,6 +227,7 @@ class GetSubscriptionRunnable final : public Runnable {
return NS_OK;
}
principal = mProxy->GetWorkerPrivate()->GetPrincipal();
+ effectiveStoragePrincipal = mProxy->GetWorkerPrivate()->GetEffectiveStoragePrincipal();
}
MOZ_ASSERT(principal);
@@ -233,11 +235,13 @@ class GetSubscriptionRunnable final : public Runnable {
RefPtr<GetSubscriptionCallback> callback =
new GetSubscriptionCallback(mProxy, mScope);
- PermissionState state;
- nsresult rv = GetPermissionState(principal, state);
- if (NS_FAILED(rv)) {
- callback->OnPushSubscriptionError(NS_ERROR_FAILURE);
- return NS_OK;
+ PermissionState state = PermissionState::Denied;
+
+ if (effectiveStoragePrincipal->OriginAttributesRef().mPartitionKey.IsEmpty()) {
+ if (NS_FAILED(GetPermissionState(principal, state))) {
+ callback->OnPushSubscriptionError(NS_ERROR_FAILURE);
+ return NS_OK;
+ }
}
if (state != PermissionState::Granted) {
@@ -256,6 +260,7 @@ class GetSubscriptionRunnable final : public Runnable {
return NS_OK;
}
+ nsresult rv;
if (mAction == PushManager::SubscribeAction) {
if (mAppServerKey.IsEmpty()) {
rv = service->Subscribe(mScope, principal, callback);
diff --git a/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini b/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini
deleted file mode 100644
index 9b31f82ff3a..00000000000
--- a/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[cross-origin-nested.tentative.https.sub.window.html]
- [third party worker]
- expected: FAIL
-
- [nested first party worker]
- expected: FAIL
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini b/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini deleted file mode 100644 index 9b31f82ff3a..00000000000 --- a/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini +++ /dev/null @@ -1,6 +0,0 @@ -[cross-origin-nested.tentative.https.sub.window.html] - [third party worker] - expected: FAIL - - [nested first party worker] - expected: FAIL
Loading diff…
References
On This Page