Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the DOM: postMessage component
ComponentDOM
Bug ClassLogic Error
Tracker1880429
Fix commit49991a8bd369 (firefox) +8/-0
CISA KEVNot listed
Creditedparanoidmoth
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
if
dom/base/PostMessageEvent.cpp
modified

Files Changed

  • dom/base/PostMessageEvent.cpp
diff --git a/dom/base/PostMessageEvent.cpp b/dom/base/PostMessageEvent.cpp
index 952b9e93958..b5ed6a79158 100644
--- a/dom/base/PostMessageEvent.cpp
+++ b/dom/base/PostMessageEvent.cpp
@@ -14,6 +14,7 @@
 #include "mozilla/dom/MessageEventBinding.h"
 #include "mozilla/dom/MessagePort.h"
 #include "mozilla/dom/RootedDictionary.h"
+#include "mozilla/dom/WindowContext.h"
 #include "mozilla/BasePrincipal.h"
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/StaticPrefs_dom.h"
@@ -52,6 +53,13 @@ PostMessageEvent::~PostMessageEvent() = default;
 
 // TODO: Convert this to MOZ_CAN_RUN_SCRIPT (bug 1415230, bug 1535398)
 MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP PostMessageEvent::Run() {
+  if (mCallerWindowID) {
+    RefPtr<WindowContext> wc = WindowContext::GetById(mCallerWindowID);
+    if (!wc || !wc->IsCurrent()) {
+      mSource = nullptr;
+    }
+  }
+
   // Note: We don't init this AutoJSAPI with targetWindow, because we do not
   // want exceptions during message deserialization to trigger error events on
   // targetWindow.
Loading diff…