High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component
ComponentNetworking
Bug ClassLogic Error
Tracker2040905
Fix commitb30705dd16ae (firefox) +23/-0
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Files Changed

  • modules/libpref/init/StaticPrefList.yaml
  • netwerk/base/nsStandardURL.cpp
diff --git a/modules/libpref/init/StaticPrefList.yaml b/modules/libpref/init/StaticPrefList.yaml
index 08beb6c32a4..0794e9b35c1 100644
--- a/modules/libpref/init/StaticPrefList.yaml
+++ b/modules/libpref/init/StaticPrefList.yaml
@@ -16097,6 +16097,13 @@
   value: 1048576
   mirror: always
 
+# Whether nsStandardURL::Deserialize should reparse the URL
+# it got from the content process
+- name: network.ipc.reparse_deserialized_uri
+  type: RelaxedAtomicBool
+  value: true
+  mirror: always
+
 # If true, use the HSTS preload list.
 - name: network.stricttransportsecurity.preloadlist
   type: RelaxedAtomicBool
diff --git a/netwerk/base/nsStandardURL.cpp b/netwerk/base/nsStandardURL.cpp
index d0ee43603a4..5c93d0b73b1 100644
--- a/netwerk/base/nsStandardURL.cpp
+++ b/netwerk/base/nsStandardURL.cpp
@@ -3499,6 +3499,15 @@ nsresult nsStandardURL::ReadPrivate(nsIObjectInputStream* stream) {
 
   NS_ENSURE_TRUE(CheckSegmentInvariants(), NS_ERROR_MALFORMED_URI);
 
+  if (StaticPrefs::network_ipc_reparse_deserialized_uri() &&
+      XRE_IsParentProcess()) {
+    nsAutoCString spec(mSpec);
+    rv = SetSpecInternal(spec);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+  }
+
   rv = CheckIfHostIsAscii();
   if (NS_FAILED(rv)) {
     return rv;
@@ -3802,6 +3811,13 @@ bool nsStandardURL::Deserialize(const URIParams& aParams) {
     return false;
   }
 
+  if (StaticPrefs::network_ipc_reparse_deserialized_uri() &&
+      XRE_IsParentProcess()) {
+    if (NS_FAILED(SetSpecInternal(params.spec()))) {
+      return false;
+    }
+  }
+
   nsresult rv = CheckIfHostIsAscii();
   if (NS_FAILED(rv)) {
     return false;
Loading diff…