PatchGap
Firefox · Core

CVE-2026-15719

Logic Error in Core
Critical firefox Logic Error 🔧 Commit mapped

Overview

Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactcritical
DescriptionWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.
ComponentCore
Bug ClassLogic Error
Tracker2043820
Fix commit04e4ed871c2c (firefox) +6/-0
CISA KEVNot listed
CreditedAtsushi Sada
Disclosed2026-07-14

Files Changed

  • docshell/base/nsDocShellLoadState.cpp

Patch

view commit
diff --git a/docshell/base/nsDocShellLoadState.cpp b/docshell/base/nsDocShellLoadState.cpp
index 957c4db74f1..ea31776de66 100644
--- a/docshell/base/nsDocShellLoadState.cpp
+++ b/docshell/base/nsDocShellLoadState.cpp
@@ -162,6 +162,12 @@ nsDocShellLoadState::nsDocShellLoadState(
       return;
     }
 
+    if (mURI->SchemeIs("javascript") &&
+        mTriggeringRemoteType != NOT_REMOTE_TYPE) {
+      aActor->FatalError("Illegal cross-process javascript: load attempt");
+      return;
+    }
+
     if (!ValidatePrincipalCouldPotentiallyBeLoadedBy(
             mTriggeringPrincipal, GetEffectiveTriggeringRemoteType(),
             {ValidatePrincipalOptions::AllowExpanded,
Loading diff…
On This Page