Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the DOM: Security component
ComponentDOM
Bug ClassLogic Error
Tracker2045496
Fix commit1abacf3593ed (firefox) +1/-1
CISA KEVNot listed
CreditedFrederik Braun
Disclosed2026-06-16

Files Changed

  • dom/security/sanitizer/Sanitizer.cpp
diff --git a/dom/security/sanitizer/Sanitizer.cpp b/dom/security/sanitizer/Sanitizer.cpp
index 8fc0804a7a0..4e120a8d8fd 100644
--- a/dom/security/sanitizer/Sanitizer.cpp
+++ b/dom/security/sanitizer/Sanitizer.cpp
@@ -1650,7 +1650,7 @@ static bool RemoveJavascriptNavigationURLAttribute(Element* aElement,
       return false;
     }
 
-    return value.EqualsLiteral("href") || value.EqualsLiteral("xlink:href");
+    return value.EqualsLiteral("href") || StringEndsWith(value, u":href"_ns);
   }
 
   return false;
Loading diff…