Firefox · DOM
CVE-2026-92075
Logic Error in DOM
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/MimeType.cpp |
modified |
Files Changed
dom/base/MimeType.cpp
Patch
diff --git a/dom/base/MimeType.cpp b/dom/base/MimeType.cpp
index 934512a1193..1dba5b852ae 100644
--- a/dom/base/MimeType.cpp
+++ b/dom/base/MimeType.cpp
@@ -252,7 +252,13 @@ TMimeType<char_type>::SplitMimetype(const nsTSubstring<char_type>& aMimeType) {
for (size_t i = 0; i < aMimeType.Length(); i++) {
char_type c = aMimeType[i];
- if (c == '\"' && (i == 0 || aMimeType[i - 1] != '\\')) {
+ // https://fetch.spec.whatwg.org/#collect-an-http-quoted-string : a
+ // backslash only escapes inside a quoted string, and it consumes the code
+ // point that follows it, so an escaped backslash does not escape the next
+ // character.
+ if (inQuotes && c == '\\') {
+ ++i;
+ } else if (c == '"') {
inQuotes = !inQuotes;
} else if (c == ',' && !inQuotes) {
mimeTypeParts.AppendElement(Substring(aMimeType, start, i - start));
Loading diff…
References
On This Page