Firefox · Toolkit
CVE-2026-12300
Logic Error in Toolkit
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
onLocationChangetoolkit/components/pageextractor/PageExtractorParent.sys.mjs |
modified | |
iftoolkit/components/pageextractor/PageExtractorParent.sys.mjs |
modified | |
iftoolkit/modules/HiddenFrame.sys.mjs |
modified |
Files Changed
toolkit/components/pageextractor/PageExtractorParent.sys.mjstoolkit/modules/HiddenFrame.sys.mjs
Patch
diff --git a/toolkit/components/pageextractor/PageExtractorParent.sys.mjs b/toolkit/components/pageextractor/PageExtractorParent.sys.mjs
index d84f7737463..7a6468d53e2 100644
--- a/toolkit/components/pageextractor/PageExtractorParent.sys.mjs
+++ b/toolkit/components/pageextractor/PageExtractorParent.sys.mjs
@@ -128,87 +128,90 @@ export class PageExtractorParent extends JSWindowActorParent {
throw new Error("Only http: and https: URLs are supported.");
}
// The hidden browser manager controls the lifetime of the hidden browser.
- return lazy.HiddenBrowserManager.withHiddenBrowser(async browser => {
- const { host } = url;
- // Create a custom message manager group for this browser so that the PageExtractor
- // actor can communicate with it. The actor is registered to use this custom
- // message manager group.
- browser.setAttribute("messagemanagergroup", "headless-browsers");
-
- /** @type {PromiseWithResolvers<PageExtractorParent>} */
- let actorResolver = Promise.withResolvers();
-
- const locationChangeFlags = Ci.nsIWebProgress.NOTIFY_LOCATION;
- const onLocationChange = {
- QueryInterface: ChromeUtils.generateQI([
- "nsIWebProgressListener",
- "nsISupportsWeakReference",
- ]),
- /**
- * @param {nsIWebProgress} webProgress
- * @param {nsIRequest} _request
- * @param {nsIURI} location
- * @param {number} _flags
- */
- onLocationChange(webProgress, _request, location, _flags) {
- if (!webProgress.isTopLevel) {
- lazy.console.log(
- "Headless browser had a non-top level location change."
- );
- return;
- }
- if (location.spec == "about:blank") {
- // about:blank is loaded first before loading the actual page.
- return;
- }
- if (URL.fromURI(location).host != host) {
- lazy.console.log(
- "A location change happened that wasn't the host.",
- location.host,
- host
- );
- // This is probably overkill, but make sure this is not a spurious
- // redirect.
- return;
- }
- browser.removeProgressListener(onLocationChange, locationChangeFlags);
-
- /** @type {any} - This is reported as an `Element`, but it's a <browser> */
- const topBrowser = webProgress.browsingContext.topFrameElement;
-
- try {
- const actor =
- topBrowser.browsingContext.currentWindowGlobal.getActor(
- "PageExtractor"
+ return lazy.HiddenBrowserManager.withHiddenBrowser(
+ async browser => {
+ const { host } = url;
+
+ /** @type {PromiseWithResolvers<PageExtractorParent>} */
+ let actorResolver = Promise.withResolvers();
+
+ const locationChangeFlags = Ci.nsIWebProgress.NOTIFY_LOCATION;
+ const onLocationChange = {
+ QueryInterface: ChromeUtils.generateQI([
+ "nsIWebProgressListener",
+ "nsISupportsWeakReference",
+ ]),
+ /**
+ * @param {nsIWebProgress} webProgress
+ * @param {nsIRequest} _request
+ * @param {nsIURI} location
+ * @param {number} _flags
+ */
+ onLocationChange(webProgress, _request, location, _flags) {
+ if (!webProgress.isTopLevel) {
+ lazy.console.log(
+ "Headless browser had a non-top level location change."
);
-
- actor.waitForPageReady().then(() => {
- lazy.console.log("Headless PageExtractor is ready", url);
- actorResolver.resolve(actor);
- });
- } catch (error) {
- // TODO (Bug 2001385) - It would be nice to catch if this is the
- // `about:neterror` page or other similar errors. This will also fail if you
- // try to access something like `about:reader` with the same error.
- actorResolver.reject(
- new Error(
- "PageExtractor could not run on that page or the page could not be found."
- )
+ return;
+ }
+ if (URL.fromURI(location).host != host) {
+ lazy.console.log(
+ "A location change happened that wasn't the host.",
+ location.host,
+ host
+ );
+ // This is probably overkill, but make sure this is not a spurious
+ // redirect.
+ return;
+ }
+ browser.removeProgressListener(
+ onLocationChange,
+ locationChangeFlags
);
- }
- },
- };
-
- browser.addProgressListener(onLocationChange, locationChangeFlags);
- lazy.console.log("Loading a headless PageExtractor", url);
-
- browser.loadURI(url.URI, {
- triggeringPrincipal:
- Services.scriptSecurityManager.getSystemPrincipal(),
- });
-
- return callback(await actorResolver.promise);
- });
+ /** @type {any} - This is reported as an `Element`, but it's a <browser> */
+ const topBrowser = webProgress.browsingContext.topFrameElement;
+
+ try {
+ const actor =
+ topBrowser.browsingContext.currentWindowGlobal.getActor(
+ "PageExtractor"
+ );
+
+ actor.waitForPageReady().then(() => {
+ lazy.console.log("Headless PageExtractor is ready", url);
+ actorResolver.resolve(actor);
+ });
+ } catch (error) {
+ // TODO (Bug 2001385) - It would be nice to catch if this is the
+ // `about:neterror` page or other similar errors. This will also fail if you
+ // try to access something like `about:reader` with the same error.
+ actorResolver.reject(
+ new Error(
+ "PageExtractor could not run on that page or the page could not be found."
+ )
+ );
+ }
+ },
+ };
+
+ browser.addProgressListener(onLocationChange, locationChangeFlags);
+
+ lazy.console.log("Loading a headless PageExtractor", url);
+
+ browser.loadURI(url.URI, {
+ triggeringPrincipal:
+ Services.scriptSecurityManager.getSystemPrincipal(),
+ });
+
+ return callback(await actorResolver.promise);
+ },
+ {
+ // Create a custom message manager group for this browser so that the PageExtractor
+ // actor can communicate with it. The actor is registered to use this custom
+ // message manager group.
+ messageManagerGroup: "headless-browsers",
+ }
+ );
}
}
diff --git a/toolkit/modules/HiddenFrame.sys.mjs b/toolkit/modules/HiddenFrame.sys.mjs
index 8a412ffe046..a6ad2841e79 100644
--- a/toolkit/modules/HiddenFrame.sys.mjs
+++ b/toolkit/modules/HiddenFrame.sys.mjs
@@ -176,6 +176,7 @@ export const HiddenBrowserManager = new (class HiddenBrowserManager {
browser.style.height = `${BACKGROUND_HEIGHT}px`;
browser.style.minHeight = `${BACKGROUND_HEIGHT}px`;
browser.setAttribute("maychangeremoteness", "true");
+ browser.setAttribute("nodefaultsrc", "true");
if (messageManagerGroup) {
browser.setAttribute("messagemanagergroup", messageManagerGroup);
}
Loading diff…
References
On This Page