Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSite isolation issue in the DOM: Navigation component
ComponentDOM
Bug ClassLogic Error
Tracker2055028
Fix commit360318a79763 (firefox) +2/-1
CISA KEVNot listed
CreditedYaqoub Aldurayhim
Disclosed2026-09-01

Files Changed

  • dom/ipc/ContentParent.cpp
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 6d418e60e28..a3b9fd9eada 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -7599,7 +7599,8 @@ mozilla::ipc::IPCResult ContentParent::RecvNotifyOnHistoryReload(
   bool canReload = false;
   Maybe<NotNull<RefPtr<nsDocShellLoadState>>> loadState;
   Maybe<bool> reloadActiveEntry;
-  if (!aContext.IsNullOrDiscarded()) {
+  if (!aContext.IsNullOrDiscarded() &&
+      aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
     aContext.get_canonical()->NotifyOnHistoryReload(
         aForceReload, canReload, loadState, reloadActiveEntry);
   }
Loading diff…