High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape due to incorrect boundary conditions in the Networking component
ComponentNetworking
Bug ClassSandbox Escape
Tracker2041610
Fix commitcadff63782f9 (firefox) +7/-0
CISA KEVNot listed
Creditedzx
Disclosed2026-06-16

Changed Functions

FunctionChangeNotes
if
netwerk/base/nsStandardURL.cpp
modified
if
netwerk/base/nsStandardURL.h
modified

Files Changed

  • netwerk/base/nsStandardURL.cpp
  • netwerk/base/nsStandardURL.h
diff --git a/netwerk/base/nsStandardURL.cpp b/netwerk/base/nsStandardURL.cpp
index 23bcb9d713e..f1ce9e203c7 100644
--- a/netwerk/base/nsStandardURL.cpp
+++ b/netwerk/base/nsStandardURL.cpp
@@ -3730,6 +3730,10 @@ bool nsStandardURL::Deserialize(const URIParams& aParams) {
   NS_ENSURE_TRUE(isSubSegment(mQuery, mPath), false);
   NS_ENSURE_TRUE(isSubSegment(mRef, mPath), false);
 
+  if (mAuthority.mLen >= 0 && mPath.mLen >= 0) {
+    NS_ENSURE_TRUE(mPath.mPos == mAuthority.mPos + mAuthority.mLen, false);
+  }
+
   if (!IsValid()) {
     return false;
   }
diff --git a/netwerk/base/nsStandardURL.h b/netwerk/base/nsStandardURL.h
index 3049cf6dd6f..79760da0268 100644
--- a/netwerk/base/nsStandardURL.h
+++ b/netwerk/base/nsStandardURL.h
@@ -412,6 +412,9 @@ class nsStandardURL : public nsIFileURL,
     }
 
     [[nodiscard]] NS_IMETHOD Finalize(nsIURI** aURI) override {
+      if (!BaseURIMutator<T>::mURI) {
+        return NS_ERROR_NULL_POINTER;
+      }
       BaseURIMutator<T>::mURI.forget(aURI);
       return NS_OK;
     }
Loading diff…