PatchGap
Firefox · Toolkit

CVE-2026-6763

Logic Error in Toolkit
Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the File Handling component
ComponentToolkit
Bug ClassLogic Error
Tracker2021666
Fix commit89b2f0f8ace5 (firefox) +7/-6
CISA KEVNot listed
CreditedTomoya Nakanishi
Disclosed2026-04-21

Files Changed

  • toolkit/components/reputationservice/ApplicationReputation.cpp
  • toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
  • xpcom/io/nsLocalFileCommon.cpp
  • xpcom/io/nsLocalFileCommon.h

Patch

view commit
diff --git a/toolkit/components/reputationservice/ApplicationReputation.cpp b/toolkit/components/reputationservice/ApplicationReputation.cpp
index 6a9f5163c04..08a32743170 100644
--- a/toolkit/components/reputationservice/ApplicationReputation.cpp
+++ b/toolkit/components/reputationservice/ApplicationReputation.cpp
@@ -433,9 +433,9 @@ const char* const ApplicationReputationService::kBinaryFileExtensions[] = {
     ".scptd",  // AppleScript
     //".scr", exec         // Windows
     //".sct", exec         // Windows shell
-    ".search-ms",  // Windows
-    ".seplugin",   // AppleScript
-    ".service",    // Systemd service unit file
+    //".search-ms", exec         // Windows Saved Search
+    ".seplugin",  // AppleScript
+    ".service",   // Systemd service unit file
     //".settingcontent-ms", exec // Windows settings
     ".sh",    // Linux shell
     ".shar",  // Linux shell
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index 218a7c0f3ef..69143b974b5 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -212,7 +212,7 @@ static const char* const kTestFileExtensions[] = {
     ".scptd",              // AppleScript
     ".scr",                // Windows
     ".sct",                // Windows shell
-    ".search-ms",          // Windows
+    ".search-ms",          // Windows Saved Search
     ".seplugin",           // AppleScript
     ".service",            // Systemd service unit file
     ".settingcontent-ms",  // Windows settings
diff --git a/xpcom/io/nsLocalFileCommon.cpp b/xpcom/io/nsLocalFileCommon.cpp
index 92d9e9ecf06..3a09a0d3b55 100644
--- a/xpcom/io/nsLocalFileCommon.cpp
+++ b/xpcom/io/nsLocalFileCommon.cpp
@@ -113,6 +113,7 @@ const char* const sExecutableExts[] = {
   ".scf",         // Windows explorer command
   ".scr",
   ".sct",
+  ".search-ms",  // Windows Saved Search
   ".settingcontent-ms",
   ".shb",
   ".shs",
diff --git a/xpcom/io/nsLocalFileCommon.h b/xpcom/io/nsLocalFileCommon.h
index b598de0f2cd..1883db6618c 100644
--- a/xpcom/io/nsLocalFileCommon.h
+++ b/xpcom/io/nsLocalFileCommon.h
@@ -6,9 +6,9 @@
 #define NS_LOCAL_FILE_COMMON_H_
 
 #ifdef MOZ_ESR
-extern const char* const sExecutableExts[110];
-#else
 extern const char* const sExecutableExts[111];
+#else
+extern const char* const sExecutableExts[112];
 #endif
 
 #endif
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index 218a7c0f3ef..69143b974b5 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -212,7 +212,7 @@ static const char* const kTestFileExtensions[] = {
     ".scptd",              // AppleScript
     ".scr",                // Windows
     ".sct",                // Windows shell
-    ".search-ms",          // Windows
+    ".search-ms",          // Windows Saved Search
     ".seplugin",           // AppleScript
     ".service",            // Systemd service unit file
     ".settingcontent-ms",  // Windows settings
Loading diff…
On This Page