Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionBy first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt.
ComponentCore
Bug ClassLogic Error
Tracker1952268
Fix commit7b9c9c970ef4 (firefox) +43/-2
CISA KEVNot listed
CreditedMatthew Noorenberghe
Disclosed2025-04-01

Changed Functions

FunctionChangeNotes
add_task
browser/components/genai/tests/browser/browser_chat_shortcuts.js
modified

Files Changed

  • browser/components/genai/GenAI.sys.mjs
  • browser/components/genai/tests/browser/browser_chat_shortcuts.js
diff --git a/browser/components/genai/GenAI.sys.mjs b/browser/components/genai/GenAI.sys.mjs
index ab4b461aab5..2cd404595e7 100644
--- a/browser/components/genai/GenAI.sys.mjs
+++ b/browser/components/genai/GenAI.sys.mjs
@@ -435,6 +435,8 @@ export const GenAI = {
     // Hide shortcuts and panel
     const hide = () => {
       aiActionButton.setAttribute("type", buttonDefaultState);
+      aiActionButton.removeEventListener("mouseover", aiActionButton.listener);
+      aiActionButton.listener = null;
       chatShortcutsOptionsPanel.hidePopup();
       selectionShortcutActionPanel.hidePopup();
     };
@@ -486,7 +488,7 @@ export const GenAI = {
         aiActionButton.setAttribute("type", buttonDefaultState);
 
         // Detect hover to build and open the popup
-        aiActionButton.addEventListener("mouseover", async () => {
+        aiActionButton.listener = async () => {
           if (aiActionButton.hasAttribute("active")) {
             return;
           }
@@ -592,7 +594,8 @@ export const GenAI = {
             provider: this.getProviderId(),
             warning: showWarning,
           });
-        });
+        };
+        aiActionButton.addEventListener("mouseover", aiActionButton.listener);
 
         // Save the latest selection so it can be used by popup
         aiActionButton.data = data;
diff --git a/browser/components/genai/tests/browser/browser_chat_shortcuts.js b/browser/components/genai/tests/browser/browser_chat_shortcuts.js
index eb7f6028685..0fb240bc56d 100644
--- a/browser/components/genai/tests/browser/browser_chat_shortcuts.js
+++ b/browser/components/genai/tests/browser/browser_chat_shortcuts.js
@@ -107,6 +107,44 @@ add_task(async function test_show_shortcuts() {
   });
 });
 
+/**
+ * Check that shortcuts shown on second tab
+ */
+add_task(async function test_show_shortcuts_second_tab() {
+  // NB: this test runs after test_show_shortcuts, which showed shortcuts
+  await BrowserTestUtils.withNewTab(
+    "data:text/html,<title>second</title>page",
+    async browser => {
+      await SimpleTest.promiseFocus(browser);
+      const selectPromise = SpecialPowers.spawn(browser, [], () => {
+        ContentTaskUtils.waitForCondition(() => content.getSelection());
+      });
+      goDoCommand("cmd_selectAll");
+      await selectPromise;
+      BrowserTestUtils.synthesizeMouseAtCenter(
+        browser,
+        { type: "mouseup" },
+        browser
+      );
+
+      await TestUtils.waitForCondition(() => {
+        const panelElement = document.getElementById(
+          "selection-shortcut-action-panel"
+        );
+        return panelElement.getAttribute("panelopen") === "true";
+      });
+      const sandbox = sinon.createSandbox();
+      const stub = sandbox.stub(GenAI, "addAskChatItems");
+
+      const shortcuts = document.querySelector("#ai-action-button");
+      EventUtils.sendMouseEvent({ type: "mouseover" }, shortcuts);
+
+      Assert.equal(stub.callCount, 1, "Shortcuts added on select");
+      Assert.equal(stub.firstCall.args[0], browser, "Got correct browser");
+    }
+  );
+});
+
 /**
  * Check that the warning label is shown when too much text is selected
  */
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/browser/components/genai/tests/browser/browser_chat_shortcuts.js b/browser/components/genai/tests/browser/browser_chat_shortcuts.js
index eb7f6028685..0fb240bc56d 100644
--- a/browser/components/genai/tests/browser/browser_chat_shortcuts.js
+++ b/browser/components/genai/tests/browser/browser_chat_shortcuts.js
@@ -107,6 +107,44 @@ add_task(async function test_show_shortcuts() {
   });
 });
 
+/**
+ * Check that shortcuts shown on second tab
+ */
+add_task(async function test_show_shortcuts_second_tab() {
+  // NB: this test runs after test_show_shortcuts, which showed shortcuts
+  await BrowserTestUtils.withNewTab(
+    "data:text/html,<title>second</title>page",
+    async browser => {
+      await SimpleTest.promiseFocus(browser);
+      const selectPromise = SpecialPowers.spawn(browser, [], () => {
+        ContentTaskUtils.waitForCondition(() => content.getSelection());
+      });
+      goDoCommand("cmd_selectAll");
+      await selectPromise;
+      BrowserTestUtils.synthesizeMouseAtCenter(
+        browser,
+        { type: "mouseup" },
+        browser
+      );
+
+      await TestUtils.waitForCondition(() => {
+        const panelElement = document.getElementById(
+          "selection-shortcut-action-panel"
+        );
+        return panelElement.getAttribute("panelopen") === "true";
+      });
+      const sandbox = sinon.createSandbox();
+      const stub = sandbox.stub(GenAI, "addAskChatItems");
+
+      const shortcuts = document.querySelector("#ai-action-button");
+      EventUtils.sendMouseEvent({ type: "mouseover" }, shortcuts);
+
+      Assert.equal(stub.callCount, 1, "Shortcuts added on select");
+      Assert.equal(stub.firstCall.args[0], browser, "Got correct browser");
+    }
+  );
+});
+
 /**
  * Check that the warning label is shown when too much text is selected
  */
Loading diff…