High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape in the DOM: Navigation component
ComponentDOM
Bug ClassSandbox Escape
Tracker2040160
Fix commit54dc16d08771 (firefox) +18/-0
CISA KEVNot listed
CreditedYaqoub Aldurayhim
Disclosed2026-06-16

Changed Functions

FunctionChangeNotes
if
dom/base/Document.cpp
modified

Files Changed

  • docshell/base/nsDocShell.cpp
  • docshell/base/nsDocShellLoadState.cpp
  • dom/base/Document.cpp
  • netwerk/protocol/viewsource/nsViewSourceChannel.cpp
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index a2e8d939f8f..92ca9d5eb1d 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -9028,6 +9028,8 @@ nsIPrincipal* nsDocShell::GetInheritedPrincipal(
     MOZ_TRY(vsh->NewSrcdocChannel(aURI, aBaseURI, aSrcdoc, aLoadInfo,
                                   getter_AddRefs(channel)));
   } else {
+    MOZ_RELEASE_ASSERT(NS_IsAboutSrcdoc(aURI));
+
     MOZ_TRY(NS_NewInputStreamChannelInternal(getter_AddRefs(channel), aURI,
                                              aSrcdoc, "text/html"_ns, aLoadInfo,
                                              true));
diff --git a/docshell/base/nsDocShellLoadState.cpp b/docshell/base/nsDocShellLoadState.cpp
index 52e6c0bc633..3d250d97275 100644
--- a/docshell/base/nsDocShellLoadState.cpp
+++ b/docshell/base/nsDocShellLoadState.cpp
@@ -163,6 +163,12 @@ nsDocShellLoadState::nsDocShellLoadState(
     }
   }
 
+  if (!mSrcdocData.IsVoid() && !mURI->SchemeIs("view-source") &&
+      !NS_IsAboutSrcdoc(mURI)) {
+    aActor->FatalError("nsDocShellLoadState with invalid srcdoc state");
+    return;
+  }
+
   // We successfully read in the data - return a success value.
   *aReadSuccess = true;
 }
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index d535a519b53..d9a2ce48b01 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -3522,6 +3522,7 @@ nsresult Document::StartDocumentLoad(const char* aCommand, nsIChannel* aChannel,
     bool isSrcdocChannel;
     inStrmChan->GetIsSrcdocChannel(&isSrcdocChannel);
     if (isSrcdocChannel) {
+      MOZ_RELEASE_ASSERT(!IsTopLevelContentDocument());
       mIsSrcdocDocument = true;
     }
   }
diff --git a/netwerk/protocol/viewsource/nsViewSourceChannel.cpp b/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
index 55710b51e14..a4f4841725c 100644
--- a/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
+++ b/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
@@ -11,6 +11,7 @@
 #include "nsIHttpHeaderVisitor.h"
 #include "nsIIOService.h"
 #include "nsIInputStreamChannel.h"
+#include "nsINestedURI.h"
 #include "nsIReferrerInfo.h"
 #include "nsMimeTypes.h"
 #include "nsNetUtil.h"
@@ -108,6 +109,14 @@ nsresult nsViewSourceChannel::InitSrcdoc(nsIURI* aURI, nsIURI* aBaseURI,
                                          nsILoadInfo* aLoadInfo) {
   nsresult rv;
 
+  MOZ_ASSERT(aURI->SchemeIs("view-source"));
+  nsCOMPtr<nsINestedURI> nestedURI(do_QueryInterface(aURI));
+  NS_ENSURE_TRUE(nestedURI, NS_ERROR_INVALID_ARG);
+  nsCOMPtr<nsIURI> innerURI;
+  rv = nestedURI->GetInnerURI(getter_AddRefs(innerURI));
+  NS_ENSURE_SUCCESS(rv, rv);
+  MOZ_RELEASE_ASSERT(NS_IsAboutSrcdoc(innerURI));
+
   nsCOMPtr<nsIURI> inStreamURI;
   // Need to strip view-source: from the URI.  Hardcoded to
   // about:srcdoc as this is the only permissible URI for srcdoc
Loading diff…