PatchGap
Firefox · Toolkit

CVE-2026-106016

Logic Error in Toolkit
Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the File Handling component
ComponentToolkit
Bug ClassLogic Error
Tracker2067465
Fix commit6d5482eb7d4a (firefox) +7/-4
CISA KEVNot listed
CreditedAbdulrahman Alzahrani
Disclosed2026-10-06

Files Changed

  • toolkit/components/reputationservice/ApplicationReputation.cpp
  • toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
  • xpcom/io/nsLocalFileCommon.cpp
  • xpcom/io/nsLocalFileCommon.h

Patch

view commit
diff --git a/toolkit/components/reputationservice/ApplicationReputation.cpp b/toolkit/components/reputationservice/ApplicationReputation.cpp
index 3f654928b55..bdaa545a555 100644
--- a/toolkit/components/reputationservice/ApplicationReputation.cpp
+++ b/toolkit/components/reputationservice/ApplicationReputation.cpp
@@ -432,7 +432,8 @@ const char* const ApplicationReputationService::kBinaryFileExtensions[] = {
     ".scptd",  // AppleScript
     //".scr", exec         // Windows
     //".sct", exec         // Windows shell
-    //".search-ms", exec         // Windows Saved Search
+    //".search-ms", exec          // Windows Saved Search
+    //".searchConnector-ms", exec // Windows Search Connector
     ".seplugin",  // AppleScript
     ".service",   // Systemd service unit file
     //".settingcontent-ms", exec // Windows settings
diff --git a/xpcom/io/nsLocalFileCommon.cpp b/xpcom/io/nsLocalFileCommon.cpp
index 49fa7860196..81fe1eeefb9 100644
--- a/xpcom/io/nsLocalFileCommon.cpp
+++ b/xpcom/io/nsLocalFileCommon.cpp
@@ -117,7 +117,8 @@ const char* const sExecutableExts[] = {
   ".scf",         // Windows explorer command
   ".scr",
   ".sct",
-  ".search-ms",  // Windows Saved Search
+  ".search-ms",           // Windows Saved Search
+  ".searchConnector-ms",  // Windows Search Connector
   ".settingcontent-ms",
   ".shb",
   ".shs",
diff --git a/xpcom/io/nsLocalFileCommon.h b/xpcom/io/nsLocalFileCommon.h
index 550e6a37613..cab9f7fb0fc 100644
--- a/xpcom/io/nsLocalFileCommon.h
+++ b/xpcom/io/nsLocalFileCommon.h
@@ -6,9 +6,9 @@
 #define NS_LOCAL_FILE_COMMON_H_
 
 #ifdef MOZ_ESR
-extern const char* const sExecutableExts[112];
-#else
 extern const char* const sExecutableExts[113];
+#else
+extern const char* const sExecutableExts[114];
 #endif
 
 #endif
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index a88a78012a1..a544b423670 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -213,6 +213,7 @@ static const char* const kTestFileExtensions[] = {
     ".scr",                // Windows
     ".sct",                // Windows shell
     ".search-ms",          // Windows Saved Search
+    ".searchConnector-ms", // Windows Search Connector
     ".seplugin",           // AppleScript
     ".service",            // Systemd service unit file
     ".settingcontent-ms",  // Windows settings
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index a88a78012a1..a544b423670 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -213,6 +213,7 @@ static const char* const kTestFileExtensions[] = {
     ".scr",                // Windows
     ".sct",                // Windows shell
     ".search-ms",          // Windows Saved Search
+    ".searchConnector-ms", // Windows Search Connector
     ".seplugin",           // AppleScript
     ".service",            // Systemd service unit file
     ".settingcontent-ms",  // Windows settings
Loading diff…
On This Page