High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMitigation bypass in the Remote Settings Client component
ComponentCore
Bug ClassLogic Error
Tracker2068952
Fix commitfa38b789cc56 (firefox) +9/-1
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
if
services/settings/RemoteSettingsClient.sys.mjs
modified

Files Changed

  • services/settings/RemoteSettingsClient.sys.mjs
diff --git a/services/settings/RemoteSettingsClient.sys.mjs b/services/settings/RemoteSettingsClient.sys.mjs
index 0e6a7172e9a..f84cdf97969 100644
--- a/services/settings/RemoteSettingsClient.sys.mjs
+++ b/services/settings/RemoteSettingsClient.sys.mjs
@@ -1191,7 +1191,15 @@ export class RemoteSettingsClient extends EventEmitter {
     if (remoteTimestamp < localTimestamp) {
       // This should never happen. Unless the CDN serves stale data.
       // If the local data is valid, then we can safely ignore this stage remote changeset.
-      const localTrustworthy = await new Promise(verifySignatureLocalData);
+      let localTrustworthy = false;
+      try {
+        localTrustworthy = await new Promise(verifySignatureLocalData);
+      } catch (exc) {
+        // Verifying the local data failed for another reason than an invalid
+        // signature (eg. its cert chain could not be fetched). Consider it
+        // untrustworthy and carry on with reset/import.
+        lazy.console.error(exc);
+      }
       if (localTrustworthy) {
         lazy.console.info(`${this.identifier} CDN served staled data, ignore.`);
         return {
Loading diff…