Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInformation disclosure in the Networking component
ComponentNetworking
Bug ClassLogic Error
Tracker2068372
Fix commit83273ab6be27 (firefox) +14/-3
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Files Changed

  • netwerk/base/nsSimpleNestedURI.cpp
diff --git a/netwerk/base/nsSimpleNestedURI.cpp b/netwerk/base/nsSimpleNestedURI.cpp
index f38be0981a8..df4f60bc4f6 100644
--- a/netwerk/base/nsSimpleNestedURI.cpp
+++ b/netwerk/base/nsSimpleNestedURI.cpp
@@ -136,12 +136,23 @@ bool nsSimpleNestedURI::Deserialize(const mozilla::ipc::URIParams& aParams) {
   const SimpleNestedURIParams& params = aParams.get_SimpleNestedURIParams();
   if (!nsSimpleURI::Deserialize(params.simpleParams())) return false;
 
-  mInnerURI = DeserializeURI(params.innerURI());
-  if (!mInnerURI || !IsValidInnerURI(mInnerURI)) {
+  nsCOMPtr<nsIURI> innerURI = DeserializeURI(params.innerURI());
+  if (!innerURI || !IsValidInnerURI(innerURI)) {
     return false;
   }
 
-  return true;
+  if (!XRE_IsParentProcess()) {
+    // A content process can trust the serialized URI
+    mInnerURI = innerURI;
+    return true;
+  }
+
+  nsAutoCString innerSpec;
+  if (NS_FAILED(innerURI->GetAsciiSpec(innerSpec))) {
+    return false;
+  }
+  mInnerURI = nullptr;
+  return NS_SUCCEEDED(NS_NewURI(getter_AddRefs(mInnerURI), innerSpec));
 }
 
 bool nsSimpleNestedURI::IsValidInnerURI(nsIURI* aInnerURI) {
Loading diff…