Medium firefox Cross Origin 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSame-origin policy bypass in the Graphics: ImageLib component
ComponentNetworking
Bug ClassCross Origin
Tracker2061794
Fix commit3a34ba4f1072 (firefox) +4/-0
CISA KEVNot listed
CreditedThe Mozilla Fuzzing Team
Disclosed2026-08-18

Files Changed

  • netwerk/protocol/http/InterceptedHttpChannel.cpp
diff --git a/netwerk/protocol/http/InterceptedHttpChannel.cpp b/netwerk/protocol/http/InterceptedHttpChannel.cpp
index 7af3a4d44fc..f094d87b789 100644
--- a/netwerk/protocol/http/InterceptedHttpChannel.cpp
+++ b/netwerk/protocol/http/InterceptedHttpChannel.cpp
@@ -915,6 +915,10 @@ InterceptedHttpChannel::StartSynthesizedResponse(
 
   mResponseHead = std::move(mSynthesizedResponseHead);
 
+  if (mLoadInfo->GetTainting() == LoadTainting::Opaque) {
+    StoreAllRedirectsSameOriginIgnoringInternal(false);
+  }
+
   if (ShouldRedirect()) {
     rv = FollowSyntheticRedirect();
     NS_ENSURE_SUCCESS(rv, rv);
Loading diff…