Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMemory safety bug fixed in Firefox 152
ComponentToolkit
Bug ClassLogic Error
Tracker1704114
Fix commit238273dd6125 (firefox) +83/-79
CISA KEVNot listed
CreditedNiklas
Disclosed2026-06-16

Changed Functions

FunctionChangeNotes
onLocationChange
toolkit/components/pageextractor/PageExtractorParent.sys.mjs
modified
if
toolkit/components/pageextractor/PageExtractorParent.sys.mjs
modified
if
toolkit/modules/HiddenFrame.sys.mjs
modified

Files Changed

  • toolkit/components/pageextractor/PageExtractorParent.sys.mjs
  • toolkit/modules/HiddenFrame.sys.mjs
diff --git a/toolkit/components/pageextractor/PageExtractorParent.sys.mjs b/toolkit/components/pageextractor/PageExtractorParent.sys.mjs
index d84f7737463..7a6468d53e2 100644
--- a/toolkit/components/pageextractor/PageExtractorParent.sys.mjs
+++ b/toolkit/components/pageextractor/PageExtractorParent.sys.mjs
@@ -128,87 +128,90 @@ export class PageExtractorParent extends JSWindowActorParent {
       throw new Error("Only http: and https: URLs are supported.");
     }
     // The hidden browser manager controls the lifetime of the hidden browser.
-    return lazy.HiddenBrowserManager.withHiddenBrowser(async browser => {
-      const { host } = url;
-      // Create a custom message manager group for this browser so that the PageExtractor
-      // actor can communicate with it. The actor is registered to use this custom
-      // message manager group.
-      browser.setAttribute("messagemanagergroup", "headless-browsers");
-
-      /** @type {PromiseWithResolvers<PageExtractorParent>} */
-      let actorResolver = Promise.withResolvers();
-
-      const locationChangeFlags = Ci.nsIWebProgress.NOTIFY_LOCATION;
-      const onLocationChange = {
-        QueryInterface: ChromeUtils.generateQI([
-          "nsIWebProgressListener",
-          "nsISupportsWeakReference",
-        ]),
-        /**
-         * @param {nsIWebProgress} webProgress
-         * @param {nsIRequest} _request
-         * @param {nsIURI} location
-         * @param {number} _flags
-         */
-        onLocationChange(webProgress, _request, location, _flags) {
-          if (!webProgress.isTopLevel) {
-            lazy.console.log(
-              "Headless browser had a non-top level location change."
-            );
-            return;
-          }
-          if (location.spec == "about:blank") {
-            // about:blank is loaded first before loading the actual page.
-            return;
-          }
-          if (URL.fromURI(location).host != host) {
-            lazy.console.log(
-              "A location change happened that wasn't the host.",
-              location.host,
-              host
-            );
-            // This is probably overkill, but make sure this is not a spurious
-            // redirect.
-            return;
-          }
-          browser.removeProgressListener(onLocationChange, locationChangeFlags);
-
-          /** @type {any} - This is reported as an `Element`, but it's a <browser> */
-          const topBrowser = webProgress.browsingContext.topFrameElement;
-
-          try {
-            const actor =
-              topBrowser.browsingContext.currentWindowGlobal.getActor(
-                "PageExtractor"
+    return lazy.HiddenBrowserManager.withHiddenBrowser(
+      async browser => {
+        const { host } = url;
+
+        /** @type {PromiseWithResolvers<PageExtractorParent>} */
+        let actorResolver = Promise.withResolvers();
+
+        const locationChangeFlags = Ci.nsIWebProgress.NOTIFY_LOCATION;
+        const onLocationChange = {
+          QueryInterface: ChromeUtils.generateQI([
+            "nsIWebProgressListener",
+            "nsISupportsWeakReference",
+          ]),
+          /**
+           * @param {nsIWebProgress} webProgress
+           * @param {nsIRequest} _request
+           * @param {nsIURI} location
+           * @param {number} _flags
+           */
+          onLocationChange(webProgress, _request, location, _flags) {
+            if (!webProgress.isTopLevel) {
+              lazy.console.log(
+                "Headless browser had a non-top level location change."
               );
-
-            actor.waitForPageReady().then(() => {
-              lazy.console.log("Headless PageExtractor is ready", url);
-              actorResolver.resolve(actor);
-            });
-          } catch (error) {
-            // TODO (Bug 2001385) - It would be nice to catch if this is the
-            // `about:neterror` page or other similar errors. This will also fail if you
-            // try to access something like `about:reader` with the same error.
-            actorResolver.reject(
-              new Error(
-                "PageExtractor could not run on that page or the page could not be found."
-              )
+              return;
+            }
+            if (URL.fromURI(location).host != host) {
+              lazy.console.log(
+                "A location change happened that wasn't the host.",
+                location.host,
+                host
+              );
+              // This is probably overkill, but make sure this is not a spurious
+              // redirect.
+              return;
+            }
+            browser.removeProgressListener(
+              onLocationChange,
+              locationChangeFlags
             );
-          }
-        },
-      };
-
-      browser.addProgressListener(onLocationChange, locationChangeFlags);
 
-      lazy.console.log("Loading a headless PageExtractor", url);
-
-      browser.loadURI(url.URI, {
-        triggeringPrincipal:
-          Services.scriptSecurityManager.getSystemPrincipal(),
-      });
-
-      return callback(await actorResolver.promise);
-    });
+            /** @type {any} - This is reported as an `Element`, but it's a <browser> */
+            const topBrowser = webProgress.browsingContext.topFrameElement;
+
+            try {
+              const actor =
+                topBrowser.browsingContext.currentWindowGlobal.getActor(
+                  "PageExtractor"
+                );
+
+              actor.waitForPageReady().then(() => {
+                lazy.console.log("Headless PageExtractor is ready", url);
+                actorResolver.resolve(actor);
+              });
+            } catch (error) {
+              // TODO (Bug 2001385) - It would be nice to catch if this is the
+              // `about:neterror` page or other similar errors. This will also fail if you
+              // try to access something like `about:reader` with the same error.
+              actorResolver.reject(
+                new Error(
+                  "PageExtractor could not run on that page or the page could not be found."
+                )
+              );
+            }
+          },
+        };
+
+        browser.addProgressListener(onLocationChange, locationChangeFlags);
+
+        lazy.console.log("Loading a headless PageExtractor", url);
+
+        browser.loadURI(url.URI, {
+          triggeringPrincipal:
+            Services.scriptSecurityManager.getSystemPrincipal(),
+        });
+
+        return callback(await actorResolver.promise);
+      },
+      {
+        // Create a custom message manager group for this browser so that the PageExtractor
+        // actor can communicate with it. The actor is registered to use this custom
+        // message manager group.
+        messageManagerGroup: "headless-browsers",
+      }
+    );
   }
 }
diff --git a/toolkit/modules/HiddenFrame.sys.mjs b/toolkit/modules/HiddenFrame.sys.mjs
index 8a412ffe046..a6ad2841e79 100644
--- a/toolkit/modules/HiddenFrame.sys.mjs
+++ b/toolkit/modules/HiddenFrame.sys.mjs
@@ -176,6 +176,7 @@ export const HiddenBrowserManager = new (class HiddenBrowserManager {
     browser.style.height = `${BACKGROUND_HEIGHT}px`;
     browser.style.minHeight = `${BACKGROUND_HEIGHT}px`;
     browser.setAttribute("maychangeremoteness", "true");
+    browser.setAttribute("nodefaultsrc", "true");
     if (messageManagerGroup) {
       browser.setAttribute("messagemanagergroup", messageManagerGroup);
     }
Loading diff…