PatchGap
Firefox · Toolkit

CVE-2025-6426

Logic Error in Toolkit
Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionThe executable file warning did not warn users before opening files with the <code>terminal</code> extension. <br>*This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*
ComponentToolkit
Bug ClassLogic Error
Tracker1964385
Fix commit46729af4eff5 (firefox) +13/-9
CISA KEVNot listed
Creditedpwn2car
Disclosed2025-06-24

Files Changed

  • toolkit/components/reputationservice/ApplicationReputation.cpp
  • toolkit/components/reputationservice/ApplicationReputation.h
  • toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
  • xpcom/io/nsLocalFileCommon.cpp
  • xpcom/io/nsLocalFileCommon.h
  • xpcom/io/nsLocalFileUnix.cpp

Patch

view commit
diff --git a/toolkit/components/reputationservice/ApplicationReputation.cpp b/toolkit/components/reputationservice/ApplicationReputation.cpp
index 5c88ff8c686..74577e38699 100644
--- a/toolkit/components/reputationservice/ApplicationReputation.cpp
+++ b/toolkit/components/reputationservice/ApplicationReputation.cpp
@@ -149,6 +149,7 @@ const char* const ApplicationReputationService::kNonBinaryExecutables[] = {
     ".air",
     ".atloc",
     ".ftploc",
+    ".terminal",
     // clang-format on
 };
 
diff --git a/toolkit/components/reputationservice/ApplicationReputation.h b/toolkit/components/reputationservice/ApplicationReputation.h
index 5ea5b825f7a..204adab34fb 100644
--- a/toolkit/components/reputationservice/ApplicationReputation.h
+++ b/toolkit/components/reputationservice/ApplicationReputation.h
@@ -25,7 +25,7 @@ class ApplicationReputationService final
   NS_DECL_NSIAPPLICATIONREPUTATIONSERVICE
 
  public:
-  static const char* const kNonBinaryExecutables[5];
+  static const char* const kNonBinaryExecutables[6];
 #ifdef XP_WIN
   static const char* const kBinaryFileExtensions[184];
 #else
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index 9e19811169d..87d59d42f52 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -241,6 +241,7 @@ static const char* const kTestFileExtensions[] = {
     ".tbz",       // Linux archive (bzip2)
     ".tbz2",      // Linux archive (bzip2)
     ".tcsh",      // Linux shell
+    ".terminal",  // Apple Terminal configuration files
     ".tgz",       // Linux archive (gzip)
     ".torrent",   // Bittorrent
     ".tpz",       // Linux archive (gzip)
diff --git a/xpcom/io/nsLocalFileCommon.cpp b/xpcom/io/nsLocalFileCommon.cpp
index a09e3715529..b7a3ead0f9a 100644
--- a/xpcom/io/nsLocalFileCommon.cpp
+++ b/xpcom/io/nsLocalFileCommon.cpp
@@ -118,6 +118,7 @@ const char* const sExecutableExts[] = {
   ".settingcontent-ms",
   ".shb",
   ".shs",
+  ".terminal",    // macOS terminal files
   ".url",
   ".vb",
   ".vbe",
diff --git a/xpcom/io/nsLocalFileCommon.h b/xpcom/io/nsLocalFileCommon.h
index cebcb136094..a37b108f891 100644
--- a/xpcom/io/nsLocalFileCommon.h
+++ b/xpcom/io/nsLocalFileCommon.h
@@ -8,9 +8,9 @@
 #define _NS_LOCAL_FILE_COMMON_H_
 
 #ifdef MOZ_ESR
-extern const char* const sExecutableExts[109];
-#else
 extern const char* const sExecutableExts[110];
+#else
+extern const char* const sExecutableExts[111];
 #endif
 
 #endif
diff --git a/xpcom/io/nsLocalFileUnix.cpp b/xpcom/io/nsLocalFileUnix.cpp
index 26fd67680ce..dd014183113 100644
--- a/xpcom/io/nsLocalFileUnix.cpp
+++ b/xpcom/io/nsLocalFileUnix.cpp
@@ -1962,12 +1962,13 @@ nsLocalFile::IsExecutable(bool* aResult) {
 #endif
         "air",  // Adobe AIR installer
 #ifdef MOZ_WIDGET_COCOA
-        "atloc",    // Can point to other files.
-        "fileloc",  // File location files can be used to point to other
-                    // files.
-        "ftploc",   // Can point to other files.
-        "inetloc",  // Shouldn't be able to do the same, but can, due to
-                    // macOS vulnerabilities.
+        "atloc",     // Can point to other files.
+        "fileloc",   // File location files can be used to point to other
+                     // files.
+        "ftploc",    // Can point to other files.
+        "inetloc",   // Shouldn't be able to do the same, but can, due to
+                     // macOS vulnerabilities.
+        "terminal",  // macOS Terminal app configuration files
 #endif
         "jar"  // java application bundle
     };
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index 9e19811169d..87d59d42f52 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -241,6 +241,7 @@ static const char* const kTestFileExtensions[] = {
     ".tbz",       // Linux archive (bzip2)
     ".tbz2",      // Linux archive (bzip2)
     ".tcsh",      // Linux shell
+    ".terminal",  // Apple Terminal configuration files
     ".tgz",       // Linux archive (gzip)
     ".torrent",   // Bittorrent
     ".tpz",       // Linux archive (gzip)
Loading diff…
On This Page