Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the DOM: Networking component
ComponentNetworking
Bug ClassLogic Error
Tracker2029482
Fix commit1f8a62d7ada1 (firefox) +28/-5
CISA KEVNot listed
CreditedAtsushi Sada
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
GetIsInDevToolsContext
netwerk/base/LoadInfo.cpp
modified
SetIsInDevToolsContext
netwerk/base/LoadInfo.cpp
modified
GetIsInThirdPartyContext
netwerk/base/LoadInfo.cpp
modified
GetIsInDevToolsContext
netwerk/base/TRRLoadInfo.cpp
modified
SetIsInDevToolsContext
netwerk/base/TRRLoadInfo.cpp
modified
GetIsInThirdPartyContext
netwerk/base/TRRLoadInfo.cpp
modified

Files Changed

  • ipc/glue/BackgroundUtils.cpp
  • netwerk/base/LoadInfo.cpp
  • netwerk/base/LoadInfo.h
  • netwerk/base/TRRLoadInfo.cpp
diff --git a/ipc/glue/BackgroundUtils.cpp b/ipc/glue/BackgroundUtils.cpp
index 8abdfa8da58..dbc3e7eb493 100644
--- a/ipc/glue/BackgroundUtils.cpp
+++ b/ipc/glue/BackgroundUtils.cpp
@@ -885,6 +885,7 @@ nsresult LoadInfoArgsToLoadInfo(const LoadInfoArgs& loadInfoArgs,
 #undef DEFINE_ARGUMENT
 
           loadInfoArgs.initialSecurityCheckDone(),
+      XRE_IsParentProcess() ? false : loadInfoArgs.isInDevToolsContext(),
       loadInfoArgs.isInThirdPartyContext(), isThirdPartyContextToTopWindow,
       loadInfoArgs.originAttributes(),
       std::move(redirectChainIncludingInternalRedirects),
diff --git a/netwerk/base/LoadInfo.cpp b/netwerk/base/LoadInfo.cpp
index a468108e714..6c074b3abc7 100644
--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@@ -774,7 +774,7 @@ LoadInfo::LoadInfo(
 #undef DEFINE_PARAMETER
 
         bool aInitialSecurityCheckDone,
-    bool aIsThirdPartyContext,
+    bool aIsInDevToolsContext, bool aIsThirdPartyContext,
     const Maybe<bool>& aIsThirdPartyContextToTopWindow,
     const OriginAttributes& aOriginAttributes,
     RedirectHistoryArray&& aRedirectChainIncludingInternalRedirects,
@@ -1066,6 +1066,20 @@ LoadInfo::GetSecurityMode(uint32_t* aFlags) {
   return NS_OK;
 }
 
+NS_IMETHODIMP
+LoadInfo::GetIsInDevToolsContext(bool* aIsInDevToolsContext) {
+  *aIsInDevToolsContext = mIsInDevToolsContext;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+LoadInfo::SetIsInDevToolsContext(bool aIsInDevToolsContext) {
+  if (XRE_IsParentProcess()) {
+    mIsInDevToolsContext = aIsInDevToolsContext;
+  }
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 LoadInfo::GetIsInThirdPartyContext(bool* aIsInThirdPartyContext) {
   *aIsInThirdPartyContext = mIsThirdPartyContext;
diff --git a/netwerk/base/LoadInfo.h b/netwerk/base/LoadInfo.h
index 797517e6959..13cd898a392 100644
--- a/netwerk/base/LoadInfo.h
+++ b/netwerk/base/LoadInfo.h
@@ -172,9 +172,6 @@ nsresult LoadInfoArgsToLoadInfo(const mozilla::net::LoadInfoArgs& aLoadInfoArgs,
          false)                                                                \
   SETTER(bool, AllowDeprecatedSystemRequests)                                  \
                                                                                \
-  GETTER(bool, IsInDevToolsContext, isInDevToolsContext, false)                \
-  SETTER(bool, IsInDevToolsContext)                                            \
-                                                                               \
   GETTER(bool, ParserCreatedScript, parserCreatedScript, false)                \
   SETTER(bool, ParserCreatedScript)                                            \
                                                                                \
@@ -423,7 +420,7 @@ class LoadInfo final : public nsILoadInfo {
 #undef DEFINE_PARAMETER
 
                bool aInitialSecurityCheckDone,
-           bool aIsThirdPartyContext,
+           bool aIsInDevToolsContext, bool aIsThirdPartyContext,
            const Maybe<bool>& aIsThirdPartyContextToTopWindow,
            const OriginAttributes& aOriginAttributes,
            RedirectHistoryArray&& aRedirectChainIncludingInternalRedirects,
@@ -518,6 +515,7 @@ class LoadInfo final : public nsILoadInfo {
 
   bool mInitialSecurityCheckDone = false;
   // NB: TYPE_DOCUMENT implies !third-party.
+  bool mIsInDevToolsContext = false;
   bool mIsThirdPartyContext = false;
   Maybe<bool> mIsThirdPartyContextToTopWindow;
   OriginAttributes mOriginAttributes;
diff --git a/netwerk/base/TRRLoadInfo.cpp b/netwerk/base/TRRLoadInfo.cpp
index 8acc7468ae6..f4894ae6220 100644
--- a/netwerk/base/TRRLoadInfo.cpp
+++ b/netwerk/base/TRRLoadInfo.cpp
@@ -128,6 +128,16 @@ TRRLoadInfo::GetSecurityMode(uint32_t* aFlags) {
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
+NS_IMETHODIMP
+TRRLoadInfo::GetIsInDevToolsContext(bool* aIsInDevToolsContext) {
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
+TRRLoadInfo::SetIsInDevToolsContext(bool aIsInDevToolsContext) {
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
 NS_IMETHODIMP
 TRRLoadInfo::GetIsInThirdPartyContext(bool* aIsInThirdPartyContext) {
   return NS_ERROR_NOT_IMPLEMENTED;
Loading diff…