PatchGap
Firefox · Core

CVE-2026-92054

Logic Error in Core
Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionPrivilege escalation in the Memory component
ComponentCore
Bug ClassLogic Error
Tracker2062551
Fix commit3b2ed8b4924f (firefox) +5/-0
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-09-15

Files Changed

  • devtools/shared/heapsnapshot/HeapSnapshotTempFileHelperParent.cpp
  • devtools/shared/heapsnapshot/tests/xpcshell/test_saveHeapSnapshot_e10s_01.js

Patch

view commit
diff --git a/devtools/shared/heapsnapshot/HeapSnapshotTempFileHelperParent.cpp b/devtools/shared/heapsnapshot/HeapSnapshotTempFileHelperParent.cpp
index 4fe8dec6e87..e126827407a 100644
--- a/devtools/shared/heapsnapshot/HeapSnapshotTempFileHelperParent.cpp
+++ b/devtools/shared/heapsnapshot/HeapSnapshotTempFileHelperParent.cpp
@@ -4,6 +4,7 @@
 
 #include "mozilla/devtools/HeapSnapshot.h"
 #include "mozilla/devtools/HeapSnapshotTempFileHelperParent.h"
+#include "mozilla/dom/ChromeUtils.h"
 #include "mozilla/ErrorResult.h"
 #include "private/pprio.h"
 
@@ -21,6 +22,9 @@ static bool openFileFailure(ErrorResult& rv,
 mozilla::ipc::IPCResult
 HeapSnapshotTempFileHelperParent::RecvOpenHeapSnapshotTempFile(
     OpenHeapSnapshotTempFileResponse* outResponse) {
+  if (!dom::ChromeUtils::IsDevToolsOpened()) {
+    return IPC_FAIL_NO_REASON(this);
+  }
   auto start = TimeStamp::Now();
   ErrorResult rv;
   nsAutoString filePath;
diff --git a/devtools/shared/heapsnapshot/tests/xpcshell/test_saveHeapSnapshot_e10s_01.js b/devtools/shared/heapsnapshot/tests/xpcshell/test_saveHeapSnapshot_e10s_01.js
index 0a466180035..497d735349d 100644
--- a/devtools/shared/heapsnapshot/tests/xpcshell/test_saveHeapSnapshot_e10s_01.js
+++ b/devtools/shared/heapsnapshot/tests/xpcshell/test_saveHeapSnapshot_e10s_01.js
@@ -5,5 +5,6 @@
 // Test saving a heap snapshot in the sandboxed e10s child process.
 
 function run_test() {
+  ChromeUtils.notifyDevToolsOpened();
   run_test_in_child("test_SaveHeapSnapshot.js");
 }
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/devtools/shared/heapsnapshot/tests/xpcshell/test_saveHeapSnapshot_e10s_01.js b/devtools/shared/heapsnapshot/tests/xpcshell/test_saveHeapSnapshot_e10s_01.js
index 0a466180035..497d735349d 100644
--- a/devtools/shared/heapsnapshot/tests/xpcshell/test_saveHeapSnapshot_e10s_01.js
+++ b/devtools/shared/heapsnapshot/tests/xpcshell/test_saveHeapSnapshot_e10s_01.js
@@ -5,5 +5,6 @@
 // Test saving a heap snapshot in the sandboxed e10s child process.
 
 function run_test() {
+  ChromeUtils.notifyDevToolsOpened();
   run_test_in_child("test_SaveHeapSnapshot.js");
 }
Loading diff…
On This Page