Firefox · Core
CVE-2026-16404
Logic Error in Core
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
receiveMessagemobile/shared/actors/GeckoViewPromptParent.sys.mjs |
modified | |
ifmobile/shared/actors/GeckoViewPromptParent.sys.mjs |
modified | |
unblockRedirectmobile/shared/actors/GeckoViewPromptParent.sys.mjs |
modified | |
ifmobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs |
modified |
Files Changed
mobile/shared/actors/GeckoViewPromptParent.sys.mjsmobile/shared/actors/moz.buildmobile/shared/components/geckoview/GeckoViewPrompt.sys.mjsmobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
Patch
diff --git a/mobile/shared/actors/GeckoViewPromptParent.sys.mjs b/mobile/shared/actors/GeckoViewPromptParent.sys.mjs
new file mode 100644
index 00000000000..9cc3eb684ad
--- /dev/null
+++ b/mobile/shared/actors/GeckoViewPromptParent.sys.mjs
@@ -0,0 +1,28 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+import { GeckoViewActorParent } from "resource://gre/modules/GeckoViewActorParent.sys.mjs";
+
+export class GeckoViewPromptParent extends GeckoViewActorParent {
+ receiveMessage({ name, data }) {
+ if (name === "GeckoView:UnblockRedirect") {
+ this.unblockRedirect(data.redirectURISpec);
+ return null;
+ }
+
+ return super.receiveMessage({ name, data });
+ }
+
+ unblockRedirect(aRedirectURISpec) {
+ const sourceWG = this.browsingContext.currentWindowGlobal;
+ if (!sourceWG) {
+ return;
+ }
+
+ const uri = Services.io.newURI(aRedirectURISpec);
+ this.browsingContext.top.loadURI(uri, {
+ triggeringPrincipal: sourceWG.documentPrincipal,
+ });
+ }
+}
diff --git a/mobile/shared/actors/moz.build b/mobile/shared/actors/moz.build
index f9572acc3d1..56ed7942f65 100644
--- a/mobile/shared/actors/moz.build
+++ b/mobile/shared/actors/moz.build
@@ -23,6 +23,7 @@ FINAL_TARGET_FILES.actors += [
"GeckoViewPromptChild.sys.mjs",
"GeckoViewPrompterChild.sys.mjs",
"GeckoViewPrompterParent.sys.mjs",
+ "GeckoViewPromptParent.sys.mjs",
"GeckoViewPushParent.sys.mjs",
"GeckoViewSettingsChild.sys.mjs",
"LoadURIDelegateChild.sys.mjs",
diff --git a/mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs b/mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs
index e195b48ca75..82622affebf 100644
--- a/mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs
+++ b/mobile/shared/components/geckoview/GeckoViewPrompt.sys.mjs
@@ -345,7 +345,10 @@ export class PromptFactory {
},
({ response }) => {
if (response && dwi) {
- dwi.top.location.href = redirectURISpec;
+ const actor = dwi.windowGlobalChild.getActor("GeckoViewPrompt");
+ actor.sendAsyncMessage("GeckoView:UnblockRedirect", {
+ redirectURISpec,
+ });
}
}
);
diff --git a/mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs b/mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
index 6996d0f77a2..9567abab0db 100644
--- a/mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
+++ b/mobile/shared/components/geckoview/GeckoViewStartup.sys.mjs
@@ -68,6 +68,9 @@ const JSWINDOWACTORS = {
includeChrome: true,
},
GeckoViewPrompt: {
+ parent: {
+ esModuleURI: "resource:///actors/GeckoViewPromptParent.sys.mjs",
+ },
child: {
esModuleURI: "resource:///actors/GeckoViewPromptChild.sys.mjs",
events: {
Loading diff…
References
On This Page