Firefox · Core
CVE-2025-9183
Logic Error in Core
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifbrowser/components/urlbar/UrlbarInput.sys.mjs |
modified | |
ifbrowser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs |
modified |
Files Changed
browser/components/urlbar/UrlbarInput.sys.mjsbrowser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs
Patch
diff --git a/browser/components/urlbar/UrlbarInput.sys.mjs b/browser/components/urlbar/UrlbarInput.sys.mjs
index 666999f3a99..db1a780f36d 100644
--- a/browser/components/urlbar/UrlbarInput.sys.mjs
+++ b/browser/components/urlbar/UrlbarInput.sys.mjs
@@ -3936,11 +3936,17 @@ export class UrlbarInput {
// do the work for the first time.
let firstView = (!isSameDocument && !dueToTabSwitch) || !state.persist;
+ let cachedUriDidChange =
+ state.persist?.originalURI &&
+ !state.persist.originalURI.equals(
+ this.window.gBrowser.selectedBrowser.originalURI
+ );
+
// Capture the shouldPersist property if it exists before
// setPersistenceState potentially modifies it.
let wasPersisting = state.persist?.shouldPersist ?? false;
- if (firstView) {
+ if (firstView || cachedUriDidChange) {
lazy.UrlbarSearchTermsPersistence.setPersistenceState(
state,
this.window.gBrowser.selectedBrowser.originalURI
diff --git a/browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs b/browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs
index 0df0e233f57..cca446c2b6b 100644
--- a/browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs
+++ b/browser/components/urlbar/UrlbarSearchTermsPersistence.sys.mjs
@@ -242,17 +242,21 @@ class _UrlbarSearchTermsPersistence {
return false;
}
- let origin;
+ let origin, pathname;
try {
- origin = URL.fromURI(uri)?.origin;
+ let url = URL.fromURI(uri);
+ origin = url.origin;
+ pathname = url.pathname;
} catch (ex) {
return false;
}
// Bug 1972464: Prevent search terms from persisting across different origin
- // due to a possible race condition. This check prevents cross-origin
- // persistence until the persistence logic is refactored.
- if (origin !== state.persist.origin) {
+ // or pathnames. This should be refactored later to be simplified.
+ if (
+ origin !== state.persist.origin ||
+ pathname !== state.persist.pathname
+ ) {
return false;
}
@@ -265,13 +269,18 @@ class _UrlbarSearchTermsPersistence {
// Whether the engine that loaded the URI is the default search engine.
isDefaultEngine: null,
- // Temporary until we resolve Bug 1972464: Cache origin for validation
- // checks. This should be removed once the architecture is refactored.
+ // Temporary until we resolve Bug 1972464 - refactor the architecture.
origin: null,
// The name of the engine that was used to load the URI.
originalEngineName: null,
+ // Temporary until we resolve Bug 1972464 - refactor the architecture.
+ originalURI: null,
+
+ // Temporary until we resolve Bug 1972464 - refactor the architecture.
+ path: null,
+
// The search provider associated with the URI. If one exists, it means
// we have custom rules for this search provider to determine whether or
// not the URI corresponds to a default search engine results page.
@@ -284,21 +293,25 @@ class _UrlbarSearchTermsPersistence {
shouldPersist: null,
};
- let origin;
+ let origin, pathname;
try {
- origin = URL.fromURI(uri)?.origin;
+ let url = URL.fromURI(uri);
+ origin = url.origin;
+ pathname = url.pathname;
} catch (ex) {
return;
}
let searchTerms = this.getSearchTerm(uri);
// Avoid setting state if either are missing.
- if (!searchTerms || !origin) {
+ if (!searchTerms || !origin || !pathname) {
return;
}
state.persist.origin = origin;
state.persist.searchTerms = searchTerms;
+ state.persist.pathname = pathname;
+ state.persist.originalURI = uri;
let provider = this.#getProviderInfoForURL(uri?.spec);
// If we have specific Remote Settings defined providers for the URL,
Loading diff…
References
On This Page