Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionMitigation bypass in the DOM: Navigation component
ComponentDOM
Bug ClassLogic Error
Tracker2066770
Fix commitb038e2a05e44 (firefox) +38/-38
CISA KEVNot listed
CreditedFinn Westendorf
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
if
dom/base/nsGlobalWindowOuter.cpp
modified

Files Changed

  • dom/base/nsGlobalWindowOuter.cpp
  • dom/clients/manager/ClientOpenWindowUtils.cpp
  • dom/documentpip/DocumentPictureInPicture.cpp
  • gfx/vr/nsFxrCommandLineHandler.cpp
  • layout/tools/layout-debug/src/nsLayoutDebugCLH.cpp
  • security/manager/pki/nsNSSDialogHelper.cpp
  • security/manager/ssl/PKCS11ModuleDB.cpp
  • toolkit/components/alerts/nsXULAlerts.cpp
  • toolkit/components/windowwatcher/nsIWindowWatcher.idl
  • toolkit/components/windowwatcher/nsPIWindowWatcher.idl
  • toolkit/components/windowwatcher/nsWindowWatcher.cpp
  • toolkit/components/windowwatcher/nsWindowWatcher.h
  • toolkit/xre/ProfileReset.cpp
  • toolkit/xre/nsAppRunner.cpp
  • widget/android/nsWindow.cpp
  • widget/uikit/nsWindow.mm
  • widget/windows/nsPrintDialogWin.cpp
diff --git a/dom/base/nsGlobalWindowOuter.cpp b/dom/base/nsGlobalWindowOuter.cpp
index 2ddc5344ff2..eea309778f6 100644
--- a/dom/base/nsGlobalWindowOuter.cpp
+++ b/dom/base/nsGlobalWindowOuter.cpp
@@ -6933,8 +6933,6 @@ nsresult nsGlobalWindowOuter::OpenInternal(
       do_GetService(NS_WINDOWWATCHER_CONTRACTID, &rv);
   NS_ENSURE_TRUE(wwatch, rv);
 
-  NS_ConvertUTF16toUTF8 name(windowName);
-
   nsCOMPtr<nsPIWindowWatcher> pwwatch(do_QueryInterface(wwatch));
   NS_ENSURE_STATE(pwwatch);
 
@@ -6969,7 +6967,7 @@ nsresult nsGlobalWindowOuter::OpenInternal(
     if (!aCalledNoScript) {
       // We asserted at the top of this function that aNavigate is true for
       // !aCalledNoScript.
-      rv = pwwatch->OpenWindow2(this, uri, name, options, modifiers,
+      rv = pwwatch->OpenWindow2(this, uri, windowName, options, modifiers,
                                 /* aCalledFromScript = */ true, aDialog,
                                 aNavigate, aArguments, isPopupSpamWindow,
                                 forceNoOpener, forceNoReferrer, wwPrintKind,
@@ -6985,7 +6983,7 @@ nsresult nsGlobalWindowOuter::OpenInternal(
       // when it tries to compute the caller principal to associate with dialog
       // arguments. That whole setup just really needs to be rewritten. :-(
       AutoNoJSAPI nojsapi;
-      rv = pwwatch->OpenWindow2(this, uri, name, options, modifiers,
+      rv = pwwatch->OpenWindow2(this, uri, windowName, options, modifiers,
                                 /* aCalledFromScript = */ false, aDialog,
                                 aNavigate, aArguments, isPopupSpamWindow,
                                 forceNoOpener, forceNoReferrer, wwPrintKind,
diff --git a/dom/clients/manager/ClientOpenWindowUtils.cpp b/dom/clients/manager/ClientOpenWindowUtils.cpp
index 4f52b8b1064..7d815768768 100644
--- a/dom/clients/manager/ClientOpenWindowUtils.cpp
+++ b/dom/clients/manager/ClientOpenWindowUtils.cpp
@@ -260,7 +260,7 @@ static Result<Ok, nsresult> OpenNewWindow(
 
   nsCOMPtr<mozIDOMWindowProxy> win;
   MOZ_TRY(ww->OpenWindow(nullptr, nsDependentCString(BROWSER_CHROME_URL_QUOTED),
-                         "_blank"_ns, features, args, getter_AddRefs(win)));
+                         u"_blank"_ns, features, args, getter_AddRefs(win)));
   return Ok();
 }
 
diff --git a/dom/documentpip/DocumentPictureInPicture.cpp b/dom/documentpip/DocumentPictureInPicture.cpp
index cb2fc309c06..272967957b0 100644
--- a/dom/documentpip/DocumentPictureInPicture.cpp
+++ b/dom/documentpip/DocumentPictureInPicture.cpp
@@ -152,7 +152,7 @@ static nsresult OpenPiPWindowUtility(nsPIDOMWindowOuter* aParent,
     features += ",disallow_return_to_opener";
   }
 
-  rv = pww->OpenWindow2(aParent, uri, "_blank"_ns, features,
+  rv = pww->OpenWindow2(aParent, uri, u"_blank"_ns, features,
                         mozilla::dom::UserActivation::Modifiers::None(), false,
                         false, true, nullptr, false, false, false,
                         nsPIWindowWatcher::PrintKind::PRINT_NONE, loadState,
diff --git a/gfx/vr/nsFxrCommandLineHandler.cpp b/gfx/vr/nsFxrCommandLineHandler.cpp
index 00b460aede5..db85a35394d 100644
--- a/gfx/vr/nsFxrCommandLineHandler.cpp
+++ b/gfx/vr/nsFxrCommandLineHandler.cpp
@@ -80,7 +80,7 @@ nsFxrCommandLineHandler::Handle(nsICommandLine* aCmdLine) {
     result = wwatch->OpenWindow(
         nullptr,                                        // aParent
         "chrome://fxr/content/fxrui.html"_ns,           // aUrl
-        "_blank"_ns,                                    // aName
+        u"_blank"_ns,                                   // aName
         "chrome,dialog=no,all,private,alwaysontop"_ns,  // aFeatures
         nullptr,                                        // aArguments
         getter_AddRefs(newWindow));
diff --git a/layout/tools/layout-debug/src/nsLayoutDebugCLH.cpp b/layout/tools/layout-debug/src/nsLayoutDebugCLH.cpp
index 620a32c6919..86063968f0a 100644
--- a/layout/tools/layout-debug/src/nsLayoutDebugCLH.cpp
+++ b/layout/tools/layout-debug/src/nsLayoutDebugCLH.cpp
@@ -223,9 +223,10 @@ nsLayoutDebugCLH::Handle(nsICommandLine* aCmdLine) {
   NS_ENSURE_TRUE(wwatch, NS_ERROR_FAILURE);
 
   nsCOMPtr<mozIDOMWindowProxy> opened;
-  wwatch->OpenWindow(
-      nullptr, "chrome://layoutdebug/content/layoutdebug.xhtml"_ns, "_blank"_ns,
-      "chrome,dialog=no,all"_ns, argsArray, getter_AddRefs(opened));
+  wwatch->OpenWindow(nullptr,
+                     "chrome://layoutdebug/content/layoutdebug.xhtml"_ns,
+                     u"_blank"_ns, "chrome,dialog=no,all"_ns, argsArray,
+                     getter_AddRefs(opened));
   aCmdLine->SetPreventDefault(true);
   return NS_OK;
 }
diff --git a/security/manager/pki/nsNSSDialogHelper.cpp b/security/manager/pki/nsNSSDialogHelper.cpp
index 4f119c94623..62f660d6dc0 100644
--- a/security/manager/pki/nsNSSDialogHelper.cpp
+++ b/security/manager/pki/nsNSSDialogHelper.cpp
@@ -37,7 +37,7 @@ nsresult nsNSSDialogHelper::openDialog(mozIDOMWindowProxy* window,
 
   nsCOMPtr<mozIDOMWindowProxy> newWindow;
   rv = windowWatcher->OpenWindow(
-      parent, nsDependentCString(url), "_blank"_ns,
+      parent, nsDependentCString(url), u"_blank"_ns,
       nsDependentCString(modal ? kOpenDialogParam : kOpenWindowParam), params,
       getter_AddRefs(newWindow));
   return rv;
diff --git a/security/manager/ssl/PKCS11ModuleDB.cpp b/security/manager/ssl/PKCS11ModuleDB.cpp
index 9584ef7af2b..9f73c1e2708 100644
--- a/security/manager/ssl/PKCS11ModuleDB.cpp
+++ b/security/manager/ssl/PKCS11ModuleDB.cpp
@@ -820,7 +820,7 @@ void ShowProtectedAuthDialog(const nsCString& tokenName,
   nsCOMPtr<mozIDOMWindowProxy> newWindow;
   (void)ww->OpenWindow(activeWindow,
                        "chrome://pippki/content/protectedAuth.xhtml"_ns,
-                       "_blank"_ns, "centerscreen,chrome,modal,titlebar"_ns,
+                       u"_blank"_ns, "centerscreen,chrome,modal,titlebar"_ns,
                        dialogArgs, getter_AddRefs(newWindow));
 }
 
diff --git a/toolkit/components/alerts/nsXULAlerts.cpp b/toolkit/components/alerts/nsXULAlerts.cpp
index b77334544ff..21badadfc86 100644
--- a/toolkit/components/alerts/nsXULAlerts.cpp
+++ b/toolkit/components/alerts/nsXULAlerts.cpp
@@ -352,7 +352,7 @@ nsresult nsXULAlerts::ShowAlertImpl(nsIAlertNotification* aAlert,
     features.AppendLiteral(",private");
   }
   rv = wwatch->OpenWindow(
-      nullptr, "chrome://global/content/alerts/alert.xhtml"_ns, "_blank"_ns,
+      nullptr, "chrome://global/content/alerts/alert.xhtml"_ns, u"_blank"_ns,
       features, argsArray, getter_AddRefs(newWindow));
   NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/toolkit/components/windowwatcher/nsIWindowWatcher.idl b/toolkit/components/windowwatcher/nsIWindowWatcher.idl
index 041d82b91d0..9af0f45f343 100644
--- a/toolkit/components/windowwatcher/nsIWindowWatcher.idl
+++ b/toolkit/components/windowwatcher/nsIWindowWatcher.idl
@@ -65,7 +65,7 @@ interface nsIWindowWatcher : nsISupports {
             via nsIObserverService if the window did not already exist.
   */
   mozIDOMWindowProxy openWindow(in mozIDOMWindowProxy aParent, in ACString aUrl,
-                                in ACString aName, in ACString aFeatures,
+                                in AString aName, in ACString aFeatures,
                                 in nsISupports aArguments);
 
   /** Clients of this service can register themselves to be notified
diff --git a/toolkit/components/windowwatcher/nsPIWindowWatcher.idl b/toolkit/components/windowwatcher/nsPIWindowWatcher.idl
index 3377a40fabf..93e4c9af3a0 100644
--- a/toolkit/components/windowwatcher/nsPIWindowWatcher.idl
+++ b/toolkit/components/windowwatcher/nsPIWindowWatcher.idl
@@ -100,7 +100,7 @@ interface nsPIWindowWatcher : nsISupports
   */
   [noscript]
   BrowsingContext openWindow2(in mozIDOMWindowProxy aParent, in nsIURI aUri,
-                              in ACString aName, in ACString aFeatures,
+                              in AString aName, in ACString aFeatures,
                               in UserActivationModifiersRef aModifiers,
                               in boolean aCalledFromScript,
                               in boolean aDialog,
diff --git a/toolkit/components/windowwatcher/nsWindowWatcher.cpp b/toolkit/components/windowwatcher/nsWindowWatcher.cpp
index 15e5f4982dd..1a7068e4d6e 100644
--- a/toolkit/components/windowwatcher/nsWindowWatcher.cpp
+++ b/toolkit/components/windowwatcher/nsWindowWatcher.cpp
@@ -275,8 +275,7 @@ static already_AddRefed<nsIArray> ConvertArgsToArray(nsISupports* aArguments) {
 
 NS_IMETHODIMP
 nsWindowWatcher::OpenWindow(mozIDOMWindowProxy* aParent, const nsACString& aUrl,
-                            const nsACString& aName,
-                            const nsACString& aFeatures,
+                            const nsAString& aName, const nsACString& aFeatures,
                             nsISupports* aArguments,
                             mozIDOMWindowProxy** aResult) {
   nsCOMPtr<nsIArray> argv = ConvertArgsToArray(aArguments);
@@ -359,7 +358,7 @@ static SizeSpec CalcSizeSpec(const WindowFeatures&, bool aHasChromeParent,
 
 NS_IMETHODIMP
 nsWindowWatcher::OpenWindow2(
-    mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsACString& aName,
+    mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsAString& aName,
     const nsACString& aFeatures, const UserActivation::Modifiers& aModifiers,
     bool aCalledFromScript, bool aDialog, bool aNavigate, nsIArray* aArguments,
     bool aIsPopupSpam, bool aForceNoOpener, bool aForceNoReferrer,
@@ -601,8 +600,8 @@ nsWindowWatcher::OpenWindowWithRemoteTab(nsIRemoteTab* aRemoteTab,
 }
 
 nsresult nsWindowWatcher::OpenWindowInternal(
-    mozIDOMWindowProxy* aParent, const nsACString& aUrl,
-    const nsACString& aName, const nsACString& aFeatures,
+    mozIDOMWindowProxy* aParent, const nsACString& aUrl, const nsAString& aName,
+    const nsACString& aFeatures,
     const mozilla::dom::UserActivation::Modifiers& aModifiers,
     bool aCalledFromJS, bool aDialog, bool aNavigate, nsIArray* aArgv,
     bool aIsPopupSpam, bool aForceNoOpener, bool aForceNoReferrer,
@@ -632,7 +631,7 @@ nsresult nsWindowWatcher::OpenWindowInternal(
 }
 
 nsresult nsWindowWatcher::OpenWindowInternal(
-    mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsACString& aName,
+    mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsAString& aName,
     const nsACString& aFeatures,
     const mozilla::dom::UserActivation::Modifiers& aModifiers,
     bool aCalledFromJS, bool aDialog, bool aNavigate, nsIArray* aArgv,
@@ -652,7 +651,7 @@ nsresult nsWindowWatcher::OpenWindowInternal(
   bool uriToLoadIsChrome = false;
 
   uint32_t chromeFlags;
-  nsAutoString name;  // string version of aName
+  nsAutoString name;  // local copy of aName, voided if unspecified
   nsCOMPtr<nsIDocShellTreeOwner>
       parentTreeOwner;               // from the parent window, if any
   RefPtr<BrowsingContext> targetBC;  // from the new window
@@ -686,7 +685,7 @@ nsresult nsWindowWatcher::OpenWindowInternal(
 
   bool nameSpecified = false;
   if (!aName.IsEmpty()) {
-    CopyUTF8toUTF16(aName, name);
+    name.Assign(aName);
     nameSpecified = true;
   } else {
     name.SetIsVoid(true);
diff --git a/toolkit/components/windowwatcher/nsWindowWatcher.h b/toolkit/components/windowwatcher/nsWindowWatcher.h
index d66bdbf1b68..47747541a55 100644
--- a/toolkit/components/windowwatcher/nsWindowWatcher.h
+++ b/toolkit/components/windowwatcher/nsWindowWatcher.h
@@ -92,13 +92,13 @@ class nsWindowWatcher : public nsIWindowWatcher,
   // (which means called from script) or called via OpenWindow.
   nsresult OpenWindowInternal(
       mozIDOMWindowProxy* aParent, const nsACString& aUrl,
-      const nsACString& aName, const nsACString& aFeatures,
+      const nsAString& aName, const nsACString& aFeatures,
       const mozilla::dom::UserActivation::Modifiers& aModifiers,
       bool aCalledFromJS, bool aDialog, bool aNavigate, nsIArray* aArgv,
       bool aIsPopupSpam, bool aForceNoOpener, bool aForceNoReferrer, PrintKind,
       nsDocShellLoadState* aLoadState, mozilla::dom::BrowsingContext** aResult);
   nsresult OpenWindowInternal(
-      mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsACString& aName,
+      mozIDOMWindowProxy* aParent, nsIURI* aUri, const nsAString& aName,
       const nsACString& aFeatures,
       const mozilla::dom::UserActivation::Modifiers& aModifiers,
       bool aCalledFromJS, bool aDialog, bool aNavigate, nsIArray* aArgv,
diff --git a/toolkit/xre/ProfileReset.cpp b/toolkit/xre/ProfileReset.cpp
index 09a5acf2097..0d4038417dc 100644
--- a/toolkit/xre/ProfileReset.cpp
+++ b/toolkit/xre/ProfileReset.cpp
@@ -114,9 +114,10 @@ nsresult ProfileResetCleanup(nsToolkitProfileService* aService,
   if (!appStartup) return NS_ERROR_FAILURE;
 
   nsCOMPtr<mozIDOMWindowProxy> progressWindow;
-  rv = windowWatcher->OpenWindow(nullptr, nsDependentCString(kResetProgressURL),
-                                 "_blank"_ns, "centerscreen,chrome,titlebar"_ns,
-                                 nullptr, getter_AddRefs(progressWindow));
+  rv =
+      windowWatcher->OpenWindow(nullptr, nsDependentCString(kResetProgressURL),
+                                u"_blank"_ns, "centerscreen,chrome,titlebar"_ns,
+                                nullptr, getter_AddRefs(progressWindow));
   if (NS_FAILED(rv)) return rv;
 
   // Create a new thread to do the bulk of profile cleanup to stay responsive.
diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index fb22d295623..e72ebc18f02 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -3096,7 +3096,7 @@ static ReturnAbortOnError ShowProfileDialog(
       }
       nsCOMPtr<mozIDOMWindowProxy> newWindow;
       rv = windowWatcher->OpenWindow(nullptr, nsDependentCString(aDialogURL),
-                                     "_blank"_ns, features, ioParamBlock,
+                                     u"_blank"_ns, features, ioParamBlock,
                                      getter_AddRefs(newWindow));
 
       NS_ENSURE_SUCCESS_LOG(rv, rv);
@@ -3604,7 +3604,7 @@ static ReturnAbortOnError HandleDetectedDowngrade(
       }
       nsCOMPtr<mozIDOMWindowProxy> newWindow;
       rv = windowWatcher->OpenWindow(
-          nullptr, nsDependentCString(kProfileDowngradeURL), "_blank"_ns,
+          nullptr, nsDependentCString(kProfileDowngradeURL), u"_blank"_ns,
           features, paramBlock, getter_AddRefs(newWindow));
       NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp
index 6cda914a721..d2bcff9b9bb 100644
--- a/widget/android/nsWindow.cpp
+++ b/widget/android/nsWindow.cpp
@@ -1886,8 +1886,8 @@ void GeckoViewSupport::Open(
     chromeFlags += ",private";
   }
   nsCOMPtr<mozIDOMWindowProxy> domWindow;
-  ww->OpenWindow(nullptr, url, nsDependentCString(aId->ToCString().get()),
-                 chromeFlags, androidView, getter_AddRefs(domWindow));
+  ww->OpenWindow(nullptr, url, aId->ToString(), chromeFlags, androidView,
+                 getter_AddRefs(domWindow));
   MOZ_RELEASE_ASSERT(domWindow);
 
   nsCOMPtr<nsPIDOMWindowOuter> pdomWindow = nsPIDOMWindowOuter::From(domWindow);
diff --git a/widget/uikit/nsWindow.mm b/widget/uikit/nsWindow.mm
index f8749ea1737..c1c4c3deb34 100644
--- a/widget/uikit/nsWindow.mm
+++ b/widget/uikit/nsWindow.mm
@@ -41,6 +41,7 @@
 
 #include "mozilla/BasicEvents.h"
 #include "mozilla/EventForwards.h"
+#include "mozilla/MacStringHelpers.h"
 #include "mozilla/ProfilerLabels.h"
 #include "mozilla/TouchEvents.h"
 #include "mozilla/dom/MouseEventBinding.h"
@@ -1289,12 +1290,12 @@ id<GeckoViewWindow> GeckoViewOpenWindow(NSString* aId,
     chromeFlags += ",private";
   }
 
+  nsAutoString windowId;
+  CopyNSStringToXPCOMString(aId, windowId);
+
   nsCOMPtr<mozIDOMWindowProxy> domWindow;
-  ww->OpenWindow(
-      nullptr, url,
-      nsDependentCString([aId UTF8String],
-                         [aId lengthOfBytesUsingEncoding:NSUTF8StringEncoding]),
-      chromeFlags, iosView, getter_AddRefs(domWindow));
+  ww->OpenWindow(nullptr, url, windowId, chromeFlags, iosView,
+                 getter_AddRefs(domWindow));
   MOZ_RELEASE_ASSERT(domWindow);
 
   nsCOMPtr<nsPIDOMWindowOuter> pdomWindow = nsPIDOMWindowOuter::From(domWindow);
diff --git a/widget/windows/nsPrintDialogWin.cpp b/widget/windows/nsPrintDialogWin.cpp
index 5edec5f8b6c..bb847b90928 100644
--- a/widget/windows/nsPrintDialogWin.cpp
+++ b/widget/windows/nsPrintDialogWin.cpp
@@ -185,7 +185,7 @@ nsresult nsPrintDialogServiceWin::DoDialog(mozIDOMWindowProxy* aParent,
 
   nsCOMPtr<mozIDOMWindowProxy> dialog;
   nsresult rv = mWatcher->OpenWindow(
-      aParent, nsDependentCString(aChromeURL), "_blank"_ns,
+      aParent, nsDependentCString(aChromeURL), u"_blank"_ns,
       "centerscreen,chrome,modal,titlebar"_ns, array, getter_AddRefs(dialog));
 
   return rv;
Loading diff…