PatchGap
Firefox · DOM

CVE-2026-92050

Logic Error in DOM
Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSandbox escape due to race condition in the XPConnect component
ComponentDOM
Bug ClassLogic Error
Tracker2061387
Fix commita901d3ec0b6e (firefox) +2/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-15

Files Changed

  • dom/ipc/ContentChild.cpp

Patch

view commit
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index e3597d7b1c1..44726e08c4f 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -3539,6 +3539,8 @@ mozilla::ipc::IPCResult ContentChild::RecvCrossProcessRedirect(
     RedirectToRealChannelArgs&& aArgs,
     nsTArray<Endpoint<extensions::PStreamFilterParent>>&& aEndpoints,
     CrossProcessRedirectResolver&& aResolve) {
+  MaybeBecomeUntrusted();
+
   nsCOMPtr<nsILoadInfo> loadInfo;
   nsresult rv = mozilla::ipc::LoadInfoArgsToLoadInfo(
       aArgs.loadInfo(), NOT_REMOTE_TYPE, getter_AddRefs(loadInfo));
Loading diff…
On This Page