Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the Networking: Cookies component
ComponentDOM
Bug ClassLogic Error
Tracker2016923
Fix commit9e4dfa048ffd (firefox) +25/-16
CISA KEVNot listed
CreditedRichard Belisle
Disclosed2026-04-21

Files Changed

  • dom/cookiestore/CookieStoreParent.cpp
  • dom/cookiestore/CookieStoreParent.h
diff --git a/dom/cookiestore/CookieStoreParent.cpp b/dom/cookiestore/CookieStoreParent.cpp
index b49e4f690b7..fcc2bb7d314 100644
--- a/dom/cookiestore/CookieStoreParent.cpp
+++ b/dom/cookiestore/CookieStoreParent.cpp
@@ -82,20 +82,24 @@ mozilla::ipc::IPCResult CookieStoreParent::RecvGetRequest(
     const bool& aOnlyFirstMatch, GetRequestResolver&& aResolver) {
   AssertIsOnBackgroundThread();
 
-  InvokeAsync(GetMainThreadSerialEventTarget(), __func__,
-              [self = RefPtr(this), uri = aCookieURI.get(), aOriginAttributes,
-               aPartitionedOriginAttributes, aThirdPartyContext,
-               aPartitionForeign, aUsingStorageAccess, aIsOn3PCBExceptionList,
-               aMatchName, aName, aPath, aOnlyFirstMatch]() {
-                CopyableTArray<CookieStruct> results;
-                self->GetRequestOnMainThread(
-                    uri, aOriginAttributes, aPartitionedOriginAttributes,
-                    aThirdPartyContext, aPartitionForeign, aUsingStorageAccess,
-                    aIsOn3PCBExceptionList, aMatchName, aName, aPath,
-                    aOnlyFirstMatch, results);
-                return GetRequestPromise::CreateAndResolve(std::move(results),
-                                                           __func__);
-              })
+  RefPtr<ThreadsafeContentParentHandle> parent =
+      BackgroundParent::GetContentParentHandle(Manager());
+
+  InvokeAsync(
+      GetMainThreadSerialEventTarget(), __func__,
+      [self = RefPtr(this), parent = RefPtr(parent), uri = aCookieURI.get(),
+       aOriginAttributes, aPartitionedOriginAttributes, aThirdPartyContext,
+       aPartitionForeign, aUsingStorageAccess, aIsOn3PCBExceptionList,
+       aMatchName, aName, aPath, aOnlyFirstMatch]() {
+        CopyableTArray<CookieStruct> results;
+        self->GetRequestOnMainThread(
+            parent, uri, aOriginAttributes, aPartitionedOriginAttributes,
+            aThirdPartyContext, aPartitionForeign, aUsingStorageAccess,
+            aIsOn3PCBExceptionList, aMatchName, aName, aPath, aOnlyFirstMatch,
+            results);
+        return GetRequestPromise::CreateAndResolve(std::move(results),
+                                                   __func__);
+      })
       ->Then(GetCurrentSerialEventTarget(), __func__,
              [aResolver = std::move(aResolver)](
                  const GetRequestPromise::ResolveOrRejectValue& aResult) {
@@ -273,7 +277,8 @@ mozilla::ipc::IPCResult CookieStoreParent::RecvClose() {
 }
 
 void CookieStoreParent::GetRequestOnMainThread(
-    const RefPtr<nsIURI> aCookieURI, const OriginAttributes& aOriginAttributes,
+    ThreadsafeContentParentHandle* aParent, const RefPtr<nsIURI> aCookieURI,
+    const OriginAttributes& aOriginAttributes,
     const Maybe<OriginAttributes>& aPartitionedOriginAttributes,
     bool aThirdPartyContext, bool aPartitionForeign, bool aUsingStorageAccess,
     bool aIsOn3PCBExceptionList, bool aMatchName, const nsAString& aName,
@@ -297,6 +302,10 @@ void CookieStoreParent::GetRequestOnMainThread(
     return;
   }
 
+  if (!CheckContentProcessSecurity(aParent, baseDomain, aOriginAttributes)) {
+    return;
+  }
+
   nsAutoCString hostName;
   rv = nsContentUtils::GetHostOrIPv6WithBrackets(aCookieURI, hostName);
   if (NS_FAILED(rv)) {
diff --git a/dom/cookiestore/CookieStoreParent.h b/dom/cookiestore/CookieStoreParent.h
index 88be368a310..54cf6aa96ce 100644
--- a/dom/cookiestore/CookieStoreParent.h
+++ b/dom/cookiestore/CookieStoreParent.h
@@ -70,7 +70,7 @@ class CookieStoreParent final : public PCookieStoreParent {
   mozilla::ipc::IPCResult RecvClose();
 
   void GetRequestOnMainThread(
-      const RefPtr<nsIURI> aCookieURI,
+      ThreadsafeContentParentHandle* aParent, const RefPtr<nsIURI> aCookieURI,
       const OriginAttributes& aOriginAttributes,
       const Maybe<OriginAttributes>& aPartitionedOriginAttributes,
       bool aThirdPartyContext, bool aPartitionForeign, bool aUsingStorageAccess,
Loading diff…