PatchGap
Firefox · Core

CVE-2026-8971

Cross Origin in Core
Low firefox Cross Origin 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionSame-origin policy bypass in the Networking: JAR component
ComponentCore
Bug ClassCross Origin
Tracker2032604
Fix commit202d7d0d63b3 (firefox) +5/-1
CISA KEVNot listed
CreditedSurya Dev Singh
Disclosed2026-05-19

Changed Functions

FunctionChangeNotes
if
modules/libjar/nsJARChannel.cpp
 modified

Files Changed

  • modules/libjar/nsJARChannel.cpp
  • modules/libjar/test/unit/test_bug1940027_embedded_null.js

Patch

view commit
diff --git a/modules/libjar/nsJARChannel.cpp b/modules/libjar/nsJARChannel.cpp
index 4c8b081e235..4f975e3ff20 100644
--- a/modules/libjar/nsJARChannel.cpp
+++ b/modules/libjar/nsJARChannel.cpp
@@ -291,6 +291,10 @@ nsresult nsJARChannel::LookupFile() {
   // have e.g. spaces in their filenames.
   NS_UnescapeURL(mJarEntry);
 
+  if (mJarEntry.FindChar('\0') != -1) {
+    return NS_ERROR_MALFORMED_URI;
+  }
+
   if (mJarFileOverride) {
     mJarFile = mJarFileOverride;
     LOG(("nsJARChannel::LookupFile [this=%p] Overriding mJarFile\n", this));
diff --git a/modules/libjar/test/unit/test_bug1940027_embedded_null.js b/modules/libjar/test/unit/test_bug1940027_embedded_null.js
index 1ae664c9276..72efc0efcba 100644
--- a/modules/libjar/test/unit/test_bug1940027_embedded_null.js
+++ b/modules/libjar/test/unit/test_bug1940027_embedded_null.js
@@ -23,7 +23,7 @@ function run_test() {
       });
       channel.open();
     },
-    /NS_ERROR_FILE_NOT_FOUND/,
+    /NS_ERROR_MALFORMED_URI/,
     "An embedded null must not truncate the path being loaded"
   );
 }
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/modules/libjar/test/unit/test_bug1940027_embedded_null.js b/modules/libjar/test/unit/test_bug1940027_embedded_null.js
index 1ae664c9276..72efc0efcba 100644
--- a/modules/libjar/test/unit/test_bug1940027_embedded_null.js
+++ b/modules/libjar/test/unit/test_bug1940027_embedded_null.js
@@ -23,7 +23,7 @@ function run_test() {
       });
       channel.open();
     },
-    /NS_ERROR_FILE_NOT_FOUND/,
+    /NS_ERROR_MALFORMED_URI/,
     "An embedded null must not truncate the path being loaded"
   );
 }
Loading diff…
On This Page