Firefox · DOM
CVE-2026-109753
Logic Error in DOM
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
docshell/base/BrowsingContext.cppdom/base/crashtests/2068441.htmldom/base/crashtests/crashtests.list
Patch
diff --git a/docshell/base/BrowsingContext.cpp b/docshell/base/BrowsingContext.cpp
index bcfcb767e89..a0a7b8df9ce 100644
--- a/docshell/base/BrowsingContext.cpp
+++ b/docshell/base/BrowsingContext.cpp
@@ -1224,7 +1224,7 @@ void BrowsingContext::PrepareForProcessChange() {
}
bool BrowsingContext::IsTargetable() const {
- return !GetClosed() && AncestorsAreCurrent();
+ return !GetClosed() && AncestorsAreCurrent() && !Top()->GetIsPrinting();
}
void BrowsingContext::SetOpener(BrowsingContext* aOpener) {
diff --git a/dom/base/crashtests/2068441.html b/dom/base/crashtests/2068441.html
new file mode 100644
index 00000000000..8784d54387c
--- /dev/null
+++ b/dom/base/crashtests/2068441.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+ canvas {
+ break-before: page;
+ }
+ .fl {
+ position: fixed;
+ top: 0px;
+ left: 0px;
+ }
+ .fl::first-letter {
+ font-size: 3em;
+ }
+</style>
+</head>
+<body>
+<iframe name="pf" srcdoc="<p>x</p>"></iframe>
+<p class="fl" id="fp"> aaa</p>
+
+<canvas></canvas>
+<script>
+function cb(state) {
+ const orig = document.querySelector("iframe[name=pf]");
+ // Brush aside the live page's browsing context for the iframe.
+ orig.name = "renamed";
+ // Printing context is still named `pf`, look for it.
+ const w = window.open("", "pf");
+ try {
+ w.parent.document.getElementById("fp").firstChild.data = "X";
+ } finally {
+ // Clean up for testing purposes.
+ w.close();
+ state.done();
+ }
+}
+
+document.querySelector("canvas").mozPrintCallback = cb;
+window.onload = () => { SpecialPowers.wrap(window).printPreview()?.close(); }
+</script>
+</body>
+</html>
+
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index 57449dbfd3e..f91d9975d9a 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -298,3 +298,4 @@ load 2035756.html
load 2042268.html
load 2052570.html
pref(dom.enable_container_timing,true) load 2068341.html
+load 2068441.html
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/dom/base/crashtests/2068441.html b/dom/base/crashtests/2068441.html
new file mode 100644
index 00000000000..8784d54387c
--- /dev/null
+++ b/dom/base/crashtests/2068441.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+ canvas {
+ break-before: page;
+ }
+ .fl {
+ position: fixed;
+ top: 0px;
+ left: 0px;
+ }
+ .fl::first-letter {
+ font-size: 3em;
+ }
+</style>
+</head>
+<body>
+<iframe name="pf" srcdoc="<p>x</p>"></iframe>
+<p class="fl" id="fp"> aaa</p>
+
+<canvas></canvas>
+<script>
+function cb(state) {
+ const orig = document.querySelector("iframe[name=pf]");
+ // Brush aside the live page's browsing context for the iframe.
+ orig.name = "renamed";
+ // Printing context is still named `pf`, look for it.
+ const w = window.open("", "pf");
+ try {
+ w.parent.document.getElementById("fp").firstChild.data = "X";
+ } finally {
+ // Clean up for testing purposes.
+ w.close();
+ state.done();
+ }
+}
+
+document.querySelector("canvas").mozPrintCallback = cb;
+window.onload = () => { SpecialPowers.wrap(window).printPreview()?.close(); }
+</script>
+</body>
+</html>
+
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index 57449dbfd3e..f91d9975d9a 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -298,3 +298,4 @@ load 2035756.html
load 2042268.html
load 2052570.html
pref(dom.enable_container_timing,true) load 2068341.html
+load 2068441.html
Loading diff…
References
On This Page