PatchGap
Firefox · Networking

CVE-2026-8950

Cross Origin in Networking
Medium firefox Cross Origin 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSame-origin policy bypass in the Networking: HTTP component
ComponentNetworking
Bug ClassCross Origin
Tracker1965430
Fix commit9af8d1dbbfa8 (firefox) +7/-9
CISA KEVNot listed
CreditedJakub Szymsza
Disclosed2026-05-19

Files Changed

  • netwerk/protocol/http/HttpBaseChannel.cpp
  • netwerk/test/mochitests/test_origin_header.html

Patch

view commit
diff --git a/netwerk/protocol/http/HttpBaseChannel.cpp b/netwerk/protocol/http/HttpBaseChannel.cpp
index 67623bfe250..04f78d08985 100644
--- a/netwerk/protocol/http/HttpBaseChannel.cpp
+++ b/netwerk/protocol/http/HttpBaseChannel.cpp
@@ -5435,14 +5435,12 @@ bool HttpBaseChannel::ShouldTaintReplacementChannelOrigin(
     return false;
   }
 
-  // If new channel is not of same origin we need to taint unless
-  // mURI <-> mOriginalURI/LoadingPrincipal are same origin.
-  if (IsNewChannelSameOrigin(aNewChannel)) {
-    return false;
+  // If new channel is same origin to the redirecting channel we need to taint
+  if (!IsNewChannelSameOrigin(aNewChannel)) {
+    return true;
   }
 
   nsresult rv;
-
   if (mLoadInfo->GetLoadingPrincipal()) {
     bool sameOrigin = false;
     rv = mLoadInfo->GetLoadingPrincipal()->IsSameOrigin(mURI, &sameOrigin);
diff --git a/netwerk/test/mochitests/test_origin_header.html b/netwerk/test/mochitests/test_origin_header.html
index 4d096e75c69..017fd684d06 100644
--- a/netwerk/test/mochitests/test_origin_header.html
+++ b/netwerk/test/mochitests/test_origin_header.html
@@ -72,9 +72,9 @@ let testsToRun = [
             framePostSrcDoc: "Origin: http://mochi.test:8888",
             framePostSrcDocXOrigin: "Origin: http://mochi.test:8888",
             framePostDataURI: "Origin: null",
-            framePostSameOriginToXOrigin: "Origin: http://mochi.test:8888",
+            framePostSameOriginToXOrigin: "Origin: null",
             framePostXOriginToSameOrigin: "Origin: null",
-            framePostXOriginToXOrigin: "Origin: http://mochi.test:8888",
+            framePostXOriginToXOrigin: "Origin: null",
         },
     },
     {
@@ -92,9 +92,9 @@ let testsToRun = [
             framePostSrcDoc: "Origin: http://mochi.test:8888",
             framePostSrcDocXOrigin: "Origin: http://mochi.test:8888",
             framePostDataURI: "Origin: null",
-            framePostSameOriginToXOrigin: "Origin: http://mochi.test:8888",
+            framePostSameOriginToXOrigin: "Origin: null",
             framePostXOriginToSameOrigin: "Origin: null",
-            framePostXOriginToXOrigin: "Origin: http://mochi.test:8888",
+            framePostXOriginToXOrigin: "Origin: null",
         },
     },
     {
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/netwerk/test/mochitests/test_origin_header.html b/netwerk/test/mochitests/test_origin_header.html
index 4d096e75c69..017fd684d06 100644
--- a/netwerk/test/mochitests/test_origin_header.html
+++ b/netwerk/test/mochitests/test_origin_header.html
@@ -72,9 +72,9 @@ let testsToRun = [
             framePostSrcDoc: "Origin: http://mochi.test:8888",
             framePostSrcDocXOrigin: "Origin: http://mochi.test:8888",
             framePostDataURI: "Origin: null",
-            framePostSameOriginToXOrigin: "Origin: http://mochi.test:8888",
+            framePostSameOriginToXOrigin: "Origin: null",
             framePostXOriginToSameOrigin: "Origin: null",
-            framePostXOriginToXOrigin: "Origin: http://mochi.test:8888",
+            framePostXOriginToXOrigin: "Origin: null",
         },
     },
     {
@@ -92,9 +92,9 @@ let testsToRun = [
             framePostSrcDoc: "Origin: http://mochi.test:8888",
             framePostSrcDocXOrigin: "Origin: http://mochi.test:8888",
             framePostDataURI: "Origin: null",
-            framePostSameOriginToXOrigin: "Origin: http://mochi.test:8888",
+            framePostSameOriginToXOrigin: "Origin: null",
             framePostXOriginToSameOrigin: "Origin: null",
-            framePostXOriginToXOrigin: "Origin: http://mochi.test:8888",
+            framePostXOriginToXOrigin: "Origin: null",
         },
     },
     {
Loading diff…
On This Page