Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionPrivilege escalation in the Places component
ComponentToolkit
Bug ClassLogic Error
Tracker2054767
Fix commit50293a1961fb (firefox) +12/-4
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
receiveMessage
toolkit/actors/ContentMetaParent.sys.mjs
modified
if
toolkit/actors/ContentMetaParent.sys.mjs
modified

Files Changed

  • toolkit/actors/ContentMetaChild.sys.mjs
  • toolkit/actors/ContentMetaParent.sys.mjs
diff --git a/toolkit/actors/ContentMetaChild.sys.mjs b/toolkit/actors/ContentMetaChild.sys.mjs
index 2d8baf79476..c6c80668ca7 100644
--- a/toolkit/actors/ContentMetaChild.sys.mjs
+++ b/toolkit/actors/ContentMetaChild.sys.mjs
@@ -180,7 +180,6 @@ export class ContentMetaChild extends JSWindowActorChild {
 
         // Save description and preview image to moz_places
         this.sendAsyncMessage("Meta:SetPageInfo", {
-          url,
           description: entry.description.value,
           previewImageURL: entry.image.value,
         });
diff --git a/toolkit/actors/ContentMetaParent.sys.mjs b/toolkit/actors/ContentMetaParent.sys.mjs
index fa7f1fe3bd6..f3d4397e25f 100644
--- a/toolkit/actors/ContentMetaParent.sys.mjs
+++ b/toolkit/actors/ContentMetaParent.sys.mjs
@@ -2,18 +2,27 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+const ACCEPTED_PROTOCOLS = new Set(["http:", "https:"]);
+
 export class ContentMetaParent extends JSWindowActorParent {
   receiveMessage(message) {
     if (message.name == "Meta:SetPageInfo") {
       let browser = this.manager.browsingContext.top.embedderElement;
       if (browser) {
+        let { description, previewImageURL } = message.data;
+        if (previewImageURL) {
+          let url = URL.parse(previewImageURL);
+          if (!url || !ACCEPTED_PROTOCOLS.has(url.protocol)) {
+            previewImageURL = null;
+          }
+        }
         let event = new browser.documentGlobal.CustomEvent("pageinfo", {
           bubbles: true,
           cancelable: false,
           detail: {
-            url: message.data.url,
-            description: message.data.description,
-            previewImageURL: message.data.previewImageURL,
+            url: this.manager.documentURI.spec,
+            description,
+            previewImageURL,
           },
         });
         browser.dispatchEvent(event);
Loading diff…