Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionWhen Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding.
ComponentNetworking
Bug ClassLogic Error
Tracker1943804
Fix commit7d01361d37df (firefox) +22/-1
CISA KEVNot listed
CreditedAlbert
Disclosed2025-06-24

Changed Functions

FunctionChangeNotes
if
netwerk/base/nsIOService.cpp
modified
getInterface
toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
modified
constructor
toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
modified

Files Changed

  • netwerk/base/nsIOService.cpp
  • toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
diff --git a/netwerk/base/nsIOService.cpp b/netwerk/base/nsIOService.cpp
index e957628acc2..ab96edf9e16 100644
--- a/netwerk/base/nsIOService.cpp
+++ b/netwerk/base/nsIOService.cpp
@@ -2190,6 +2190,10 @@ nsresult nsIOService::SpeculativeConnectInternal(
     loadFlags |= nsIRequest::LOAD_ANONYMOUS;
     channel->SetLoadFlags(loadFlags);
   }
+  if (aCallbacks) {
+    rv = channel->SetNotificationCallbacks(aCallbacks);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
   nsCOMPtr<nsICancelable> cancelable;
   RefPtr<IOServiceProxyCallback> callback = new IOServiceProxyCallback(
diff --git a/toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs b/toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
index 0745607f549..bef43e68d4c 100644
--- a/toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
+++ b/toolkit/components/remotebrowserutils/RemoteWebNavigation.sys.mjs
@@ -8,6 +8,18 @@ ChromeUtils.defineESModuleGetters(lazy, {
   PrivateBrowsingUtils: "resource://gre/modules/PrivateBrowsingUtils.sys.mjs",
 });
 
+function NotificationCallbacks(browser) {
+  this._browser = browser;
+}
+NotificationCallbacks.prototype = {
+  QueryInterface: ChromeUtils.generateQI(["nsIInterfaceRequestor"]),
+  getInterface(iid) {
+    if (iid.equals(Ci.nsILoadContext)) {
+      return this._browser.browsingContext;
+    }
+  },
+};
+
 // This object implements the JS parts of nsIWebNavigation.
 export class RemoteWebNavigation {
   constructor(aBrowser) {
@@ -109,7 +121,12 @@ export class RemoteWebNavigation {
             attrs
           );
         }
-        Services.io.speculativeConnect(uri, principal, null, false);
+        Services.io.speculativeConnect(
+          uri,
+          principal,
+          new NotificationCallbacks(this._browser),
+          false
+        );
       }
     } catch (ex) {
       // Can't setup speculative connection for this uri for some
Loading diff…