Medium firefox Cross Origin 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSame-origin policy bypass in the Request Handling component
ComponentToolkit
Bug ClassCross Origin
Tracker2000218
Fix commita60437b4b24c (firefox) +1/-1
CISA KEVNot listed
CreditedIgor Morgenstern
Disclosed2025-12-09

Files Changed

  • toolkit/components/extensions/parent/ext-identity.js
diff --git a/toolkit/components/extensions/parent/ext-identity.js b/toolkit/components/extensions/parent/ext-identity.js
index e23a29b8024..c3d1bf18d25 100644
--- a/toolkit/components/extensions/parent/ext-identity.js
+++ b/toolkit/components/extensions/parent/ext-identity.js
@@ -77,7 +77,7 @@ const openOAuthWindow = (details, redirectURI) => {
       // Early exit if channel isn't related to the oauth dialog.
       let wrapper = ChannelWrapper.get(channel);
       if (
-        !wrapper.browserElement &&
+        !wrapper.browserElement ||
         wrapper.browserElement !== window.gBrowser.selectedBrowser
       ) {
         return;
Loading diff…