Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionSandbox escape due to incorrect boundary conditions in the Widget: Win32 component
ComponentWidget
Bug ClassLogic Error
Tracker2057113
Fix commit98ca727cca53 (firefox) +23/-3
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
if
widget/windows/nsClipboard.cpp
modified

Files Changed

  • widget/windows/nsClipboard.cpp
diff --git a/widget/windows/nsClipboard.cpp b/widget/windows/nsClipboard.cpp
index 15359f6c902..b7930edbae1 100644
--- a/widget/windows/nsClipboard.cpp
+++ b/widget/windows/nsClipboard.cpp
@@ -370,6 +370,9 @@ nsresult nsClipboard::SetupNativeDataObject(
   mozilla::widget::WebCustomFormatMap webCustomFormatMap;
   uint32_t webCustomFormatIndex = 0;
 
+  bool hasText = false;
+  bool hasFilePromise = false;
+
   // Walk through flavors that contain data and register them
   // into the DataObj as supported flavors
   for (uint32_t i = 0; i < flavors.Length(); i++) {
@@ -404,6 +407,11 @@ nsresult nsClipboard::SetupNativeDataObject(
     SET_FORMATETC(fe, format, 0, DVASPECT_CONTENT, -1, TYMED_HGLOBAL);
     dObj->AddDataFlavor(flavorStr.get(), &fe);
 
+    if (flavorStr.EqualsLiteral(kFilePromiseMime) ||
+        flavorStr.EqualsLiteral(kFilePromiseURLMime)) {
+      hasFilePromise = true;
+    }
+
     // Do various things internal to the implementation, like map one
     // flavor to another or add additional flavors based on what's required
     // for the win32 impl.
@@ -413,9 +421,7 @@ nsresult nsClipboard::SetupNativeDataObject(
       FORMATETC textFE;
       SET_FORMATETC(textFE, CF_TEXT, 0, DVASPECT_CONTENT, -1, TYMED_HGLOBAL);
       dObj->AddDataFlavor(kTextMime, &textFE);
-      if (aMightNeedToFlush) {
-        *aMightNeedToFlush = MightNeedToFlush::Yes;
-      }
+      hasText = true;
     } else if (flavorStr.EqualsLiteral(kHTMLMime)) {
       // if we find text/html, also advertise win32's html flavor (which we will
       // convert on our own in nsDataObj::GetText().
@@ -489,6 +495,20 @@ nsresult nsClipboard::SetupNativeDataObject(
     }
   }
 
+  if (aMightNeedToFlush) {
+    // We flush in order to stop Windows Suggested Actions walking the a11y
+    // tree, which it only does for text (bug 1774285).  Rendering a file
+    // promise, however, fetches the promised URL under a nested event loop, so
+    // a transferable carrying both would trade the tree walk for a main-thread
+    // network fetch.  We choose the tree-walk penalty instead, in this case.
+    // This means that bug 1774285 reappears for that combination.  However,
+    // the combination would naturally be very rare (clipboard ops including
+    // both text and files simultaneously are not common) and should be
+    // impossible while clipboard.imageAsFile.enabled is false (the default).
+    *aMightNeedToFlush = hasText && !hasFilePromise ? MightNeedToFlush::Yes
+                                                    : MightNeedToFlush::No;
+  }
+
   if (!webCustomFormatMap.IsEmpty()) {
     // Publish the web-custom-format map alongside the per-slot payloads.
     // The JSON is held on the data object so nsDataObj::GetText can serve
Loading diff…