Firefox · Networking
CVE-2026-92041
Logic Error in Networking
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
GetIsInDevToolsContextnetwerk/base/LoadInfo.cpp |
modified | |
SetIsInDevToolsContextnetwerk/base/LoadInfo.cpp |
modified | |
GetIsInThirdPartyContextnetwerk/base/LoadInfo.cpp |
modified | |
GetIsInDevToolsContextnetwerk/base/TRRLoadInfo.cpp |
modified | |
SetIsInDevToolsContextnetwerk/base/TRRLoadInfo.cpp |
modified | |
GetIsInThirdPartyContextnetwerk/base/TRRLoadInfo.cpp |
modified |
Files Changed
ipc/glue/BackgroundUtils.cppnetwerk/base/LoadInfo.cppnetwerk/base/LoadInfo.hnetwerk/base/TRRLoadInfo.cpp
Patch
diff --git a/ipc/glue/BackgroundUtils.cpp b/ipc/glue/BackgroundUtils.cpp
index 8abdfa8da58..dbc3e7eb493 100644
--- a/ipc/glue/BackgroundUtils.cpp
+++ b/ipc/glue/BackgroundUtils.cpp
@@ -885,6 +885,7 @@ nsresult LoadInfoArgsToLoadInfo(const LoadInfoArgs& loadInfoArgs,
#undef DEFINE_ARGUMENT
loadInfoArgs.initialSecurityCheckDone(),
+ XRE_IsParentProcess() ? false : loadInfoArgs.isInDevToolsContext(),
loadInfoArgs.isInThirdPartyContext(), isThirdPartyContextToTopWindow,
loadInfoArgs.originAttributes(),
std::move(redirectChainIncludingInternalRedirects),
diff --git a/netwerk/base/LoadInfo.cpp b/netwerk/base/LoadInfo.cpp
index a468108e714..6c074b3abc7 100644
--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@@ -774,7 +774,7 @@ LoadInfo::LoadInfo(
#undef DEFINE_PARAMETER
bool aInitialSecurityCheckDone,
- bool aIsThirdPartyContext,
+ bool aIsInDevToolsContext, bool aIsThirdPartyContext,
const Maybe<bool>& aIsThirdPartyContextToTopWindow,
const OriginAttributes& aOriginAttributes,
RedirectHistoryArray&& aRedirectChainIncludingInternalRedirects,
@@ -1066,6 +1066,20 @@ LoadInfo::GetSecurityMode(uint32_t* aFlags) {
return NS_OK;
}
+NS_IMETHODIMP
+LoadInfo::GetIsInDevToolsContext(bool* aIsInDevToolsContext) {
+ *aIsInDevToolsContext = mIsInDevToolsContext;
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+LoadInfo::SetIsInDevToolsContext(bool aIsInDevToolsContext) {
+ if (XRE_IsParentProcess()) {
+ mIsInDevToolsContext = aIsInDevToolsContext;
+ }
+ return NS_OK;
+}
+
NS_IMETHODIMP
LoadInfo::GetIsInThirdPartyContext(bool* aIsInThirdPartyContext) {
*aIsInThirdPartyContext = mIsThirdPartyContext;
diff --git a/netwerk/base/LoadInfo.h b/netwerk/base/LoadInfo.h
index 797517e6959..13cd898a392 100644
--- a/netwerk/base/LoadInfo.h
+++ b/netwerk/base/LoadInfo.h
@@ -172,9 +172,6 @@ nsresult LoadInfoArgsToLoadInfo(const mozilla::net::LoadInfoArgs& aLoadInfoArgs,
false) \
SETTER(bool, AllowDeprecatedSystemRequests) \
\
- GETTER(bool, IsInDevToolsContext, isInDevToolsContext, false) \
- SETTER(bool, IsInDevToolsContext) \
- \
GETTER(bool, ParserCreatedScript, parserCreatedScript, false) \
SETTER(bool, ParserCreatedScript) \
\
@@ -423,7 +420,7 @@ class LoadInfo final : public nsILoadInfo {
#undef DEFINE_PARAMETER
bool aInitialSecurityCheckDone,
- bool aIsThirdPartyContext,
+ bool aIsInDevToolsContext, bool aIsThirdPartyContext,
const Maybe<bool>& aIsThirdPartyContextToTopWindow,
const OriginAttributes& aOriginAttributes,
RedirectHistoryArray&& aRedirectChainIncludingInternalRedirects,
@@ -518,6 +515,7 @@ class LoadInfo final : public nsILoadInfo {
bool mInitialSecurityCheckDone = false;
// NB: TYPE_DOCUMENT implies !third-party.
+ bool mIsInDevToolsContext = false;
bool mIsThirdPartyContext = false;
Maybe<bool> mIsThirdPartyContextToTopWindow;
OriginAttributes mOriginAttributes;
diff --git a/netwerk/base/TRRLoadInfo.cpp b/netwerk/base/TRRLoadInfo.cpp
index 8acc7468ae6..f4894ae6220 100644
--- a/netwerk/base/TRRLoadInfo.cpp
+++ b/netwerk/base/TRRLoadInfo.cpp
@@ -128,6 +128,16 @@ TRRLoadInfo::GetSecurityMode(uint32_t* aFlags) {
return NS_ERROR_NOT_IMPLEMENTED;
}
+NS_IMETHODIMP
+TRRLoadInfo::GetIsInDevToolsContext(bool* aIsInDevToolsContext) {
+ return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
+TRRLoadInfo::SetIsInDevToolsContext(bool aIsInDevToolsContext) {
+ return NS_ERROR_NOT_IMPLEMENTED;
+}
+
NS_IMETHODIMP
TRRLoadInfo::GetIsInThirdPartyContext(bool* aIsInThirdPartyContext) {
return NS_ERROR_NOT_IMPLEMENTED;
Loading diff…
References
On This Page