High firefox Cross Origin 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSame-origin policy bypass in the DOM: Networking component
ComponentNetworking
Bug ClassCross Origin
Tracker2038803
Fix commit008bab1f0dff (firefox) +23/-5
CISA KEVNot listed
Creditedsatyamasd
Disclosed2026-05-19

Changed Functions

FunctionChangeNotes
GetTainting
netwerk/base/LoadInfo.cpp
modified
GetTainting
netwerk/base/TRRLoadInfo.cpp
modified

Files Changed

  • ipc/glue/BackgroundUtils.cpp
  • netwerk/base/LoadInfo.cpp
  • netwerk/base/LoadInfo.h
  • netwerk/base/TRRLoadInfo.cpp
diff --git a/ipc/glue/BackgroundUtils.cpp b/ipc/glue/BackgroundUtils.cpp
index 35bc5fd63d7..5bac0c19d36 100644
--- a/ipc/glue/BackgroundUtils.cpp
+++ b/ipc/glue/BackgroundUtils.cpp
@@ -877,6 +877,7 @@ nsresult LoadInfoArgsToLoadInfo(const LoadInfoArgs& loadInfoArgs,
       reservedClientInfo, initialClientInfo, controller,
       loadInfoArgs.securityFlags(), loadInfoArgs.sandboxFlags(),
       loadInfoArgs.contentPolicyType(),
+      loadInfoArgs.serviceWorkerTaintingSynthesized(),
       static_cast<LoadTainting>(loadInfoArgs.tainting()),
 
 #define DEFINE_ARGUMENT(_t, _n, name, _d) loadInfoArgs.name(),
diff --git a/netwerk/base/LoadInfo.cpp b/netwerk/base/LoadInfo.cpp
index 5359994177e..a9abddc425e 100644
--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@@ -723,6 +723,8 @@ LoadInfo::LoadInfo(const LoadInfo& rhs)
       mSecurityFlags(rhs.mSecurityFlags),
       mSandboxFlags(rhs.mSandboxFlags),
       mInternalContentPolicyType(rhs.mInternalContentPolicyType),
+      // mServiceWorkerTaintingSynthesized must be handled specially during
+      // redirect
       mTainting(rhs.mTainting),
 #define DEFINE_INIT(_t, name, _n, _d) m##name(rhs.m##name),
       LOADINFO_FOR_EACH_FIELD(DEFINE_INIT, LOADINFO_DUMMY_SETTER)
@@ -764,7 +766,8 @@ LoadInfo::LoadInfo(
     const Maybe<ClientInfo>& aInitialClientInfo,
     const Maybe<ServiceWorkerDescriptor>& aController,
     nsSecurityFlags aSecurityFlags, uint32_t aSandboxFlags,
-    nsContentPolicyType aContentPolicyType, LoadTainting aTainting,
+    nsContentPolicyType aContentPolicyType,
+    bool aServiceWorkerTaintingSynthesized, LoadTainting aTainting,
 #define DEFINE_PARAMETER(type, name, _n, _d) type a##name,
     LOADINFO_FOR_EACH_FIELD(DEFINE_PARAMETER, LOADINFO_DUMMY_SETTER)
 #undef DEFINE_PARAMETER
@@ -803,6 +806,7 @@ LoadInfo::LoadInfo(
       mSecurityFlags(aSecurityFlags),
       mSandboxFlags(aSandboxFlags),
       mInternalContentPolicyType(aContentPolicyType),
+      mServiceWorkerTaintingSynthesized(aServiceWorkerTaintingSynthesized),
       mTainting(aTainting),
 
 #define DEFINE_INIT(_t, name, _n, _d) m##name(a##name),
@@ -1661,6 +1665,14 @@ LoadInfo::GetLoadTriggeredFromExternal(bool* aLoadTriggeredFromExternal) {
   return NS_OK;
 }
 
+NS_IMETHODIMP
+LoadInfo::GetServiceWorkerTaintingSynthesized(
+    bool* aServiceWorkerTaintingSynthesized) {
+  MOZ_ASSERT(aServiceWorkerTaintingSynthesized);
+  *aServiceWorkerTaintingSynthesized = mServiceWorkerTaintingSynthesized;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 LoadInfo::GetTainting(uint32_t* aTaintingOut) {
   MOZ_ASSERT(aTaintingOut);
diff --git a/netwerk/base/LoadInfo.h b/netwerk/base/LoadInfo.h
index 50052f1af15..797517e6959 100644
--- a/netwerk/base/LoadInfo.h
+++ b/netwerk/base/LoadInfo.h
@@ -139,9 +139,6 @@ nsresult LoadInfoArgsToLoadInfo(const mozilla::net::LoadInfoArgs& aLoadInfoArgs,
                                                                                \
   GETTER(bool, IsPreflight, isPreflight, false)                                \
                                                                                \
-  GETTER(bool, ServiceWorkerTaintingSynthesized,                               \
-         serviceWorkerTaintingSynthesized, false)                              \
-                                                                               \
   GETTER(bool, DocumentHasUserInteracted, documentHasUserInteracted, false)    \
   SETTER(bool, DocumentHasUserInteracted)                                      \
                                                                                \
@@ -418,7 +415,8 @@ class LoadInfo final : public nsILoadInfo {
            const Maybe<mozilla::dom::ClientInfo>& aInitialClientInfo,
            const Maybe<mozilla::dom::ServiceWorkerDescriptor>& aController,
            nsSecurityFlags aSecurityFlags, uint32_t aSandboxFlags,
-           nsContentPolicyType aContentPolicyType, LoadTainting aTainting,
+           nsContentPolicyType aContentPolicyType,
+           bool aServiceWorkerTaintingSynthesized, LoadTainting aTainting,
 
 #define DEFINE_PARAMETER(type, name, _n, _d) type a##name,
            LOADINFO_FOR_EACH_FIELD(DEFINE_PARAMETER, LOADINFO_DUMMY_SETTER)
@@ -511,6 +509,7 @@ class LoadInfo final : public nsILoadInfo {
   dom::ReferrerPolicy mFrameReferrerPolicySnapshot =
       dom::ReferrerPolicy::_empty;
   nsContentPolicyType mInternalContentPolicyType;
+  bool mServiceWorkerTaintingSynthesized = false;
   LoadTainting mTainting = LoadTainting::Basic;
 
 #define DEFINE_FIELD(type, name, _, default_init) type m##name = default_init;
diff --git a/netwerk/base/TRRLoadInfo.cpp b/netwerk/base/TRRLoadInfo.cpp
index debfc6aa22b..8acc7468ae6 100644
--- a/netwerk/base/TRRLoadInfo.cpp
+++ b/netwerk/base/TRRLoadInfo.cpp
@@ -355,6 +355,12 @@ TRRLoadInfo::GetLoadTriggeredFromExternal(bool* aLoadTriggeredFromExternal) {
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
+NS_IMETHODIMP
+TRRLoadInfo::GetServiceWorkerTaintingSynthesized(
+    bool* aServiceWorkerTaintingSynthesized) {
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
 NS_IMETHODIMP
 TRRLoadInfo::GetTainting(uint32_t* aTaintingOut) {
   return NS_ERROR_NOT_IMPLEMENTED;
Loading diff…