PatchGap
Firefox · Toolkit

CVE-2026-109763

Logic Error in Toolkit
Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the File Handling component
ComponentToolkit
Bug ClassLogic Error
Tracker2072501
Fix commit57c3f4e2ba4a (firefox) +5/-2
CISA KEVNot listed
CreditedRiku Bamba
Disclosed2026-10-13

Files Changed

  • toolkit/components/reputationservice/ApplicationReputation.cpp
  • toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
  • xpcom/io/nsLocalFileCommon.cpp
  • xpcom/io/nsLocalFileCommon.h

Patch

view commit
diff --git a/toolkit/components/reputationservice/ApplicationReputation.cpp b/toolkit/components/reputationservice/ApplicationReputation.cpp
index bdaa545a555..470f26f07a0 100644
--- a/toolkit/components/reputationservice/ApplicationReputation.cpp
+++ b/toolkit/components/reputationservice/ApplicationReputation.cpp
@@ -173,6 +173,7 @@ const char* const ApplicationReputationService::kBinaryFileExtensions[] = {
     //".air", exec // Adobe AIR installer; excluded from apprep checks.
     ".apk",  // Android package
     //".app", exec  // Executable application
+    //".appcontent-ms", exec
     ".applescript",
     //".application", exec // MS ClickOnce
     //".appref-ms", exec // MS ClickOnce
diff --git a/xpcom/io/nsLocalFileCommon.cpp b/xpcom/io/nsLocalFileCommon.cpp
index 81fe1eeefb9..a1f94b325d9 100644
--- a/xpcom/io/nsLocalFileCommon.cpp
+++ b/xpcom/io/nsLocalFileCommon.cpp
@@ -42,6 +42,7 @@ const char* const sExecutableExts[] = {
   ".afploc",      // Apple Filing Protocol Location
   ".air",         // Adobe AIR installer
   ".app",         // executable application
+  ".appcontent-ms",
   ".application", // from bug 348763
   ".appref-ms",   // ClickOnce link
   ".appx",
diff --git a/xpcom/io/nsLocalFileCommon.h b/xpcom/io/nsLocalFileCommon.h
index cab9f7fb0fc..0b583c22e48 100644
--- a/xpcom/io/nsLocalFileCommon.h
+++ b/xpcom/io/nsLocalFileCommon.h
@@ -6,9 +6,9 @@
 #define NS_LOCAL_FILE_COMMON_H_
 
 #ifdef MOZ_ESR
-extern const char* const sExecutableExts[113];
-#else
 extern const char* const sExecutableExts[114];
+#else
+extern const char* const sExecutableExts[115];
 #endif
 
 #endif
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index a544b423670..b96379695ad 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -21,6 +21,7 @@ static const char* const kTestFileExtensions[] = {
     ".air",     // Adobe Air (ignored for app rep)
     ".apk",     // Android package
     ".app",     // Executable application
+    ".appcontent-ms",
     ".applescript",
     ".application",  // MS ClickOnce
     ".appref-ms",    // MS ClickOnce
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index a544b423670..b96379695ad 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -21,6 +21,7 @@ static const char* const kTestFileExtensions[] = {
     ".air",     // Adobe Air (ignored for app rep)
     ".apk",     // Android package
     ".app",     // Executable application
+    ".appcontent-ms",
     ".applescript",
     ".application",  // MS ClickOnce
     ".appref-ms",    // MS ClickOnce
Loading diff…
On This Page