High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionPrivilege escalation in the DOM: Navigation component
ComponentNetworking
Bug ClassLogic Error
Tracker2054416
Fix commit3ec5c71b41bb (firefox) +13/-5
CISA KEVNot listed
Creditedchoeseyeong
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
if
docshell/base/nsDocShellLoadState.cpp
modified

Files Changed

  • docshell/base/nsDocShellLoadState.cpp
  • netwerk/ipc/DocumentLoadListener.cpp
diff --git a/docshell/base/nsDocShellLoadState.cpp b/docshell/base/nsDocShellLoadState.cpp
index ea31776de66..12b11965ab4 100644
--- a/docshell/base/nsDocShellLoadState.cpp
+++ b/docshell/base/nsDocShellLoadState.cpp
@@ -162,10 +162,16 @@ nsDocShellLoadState::nsDocShellLoadState(
       return;
     }
 
-    if (mURI->SchemeIs("javascript") &&
-        mTriggeringRemoteType != NOT_REMOTE_TYPE) {
-      aActor->FatalError("Illegal cross-process javascript: load attempt");
-      return;
+    if (mTriggeringRemoteType != NOT_REMOTE_TYPE) {
+      if (mURI->SchemeIs("javascript")) {
+        aActor->FatalError("Illegal cross-process javascript: load attempt");
+        return;
+      }
+
+      if (mRemoteTypeOverride.isSome()) {
+        aActor->FatalError("RemoteTypeOverride can only be set by parent");
+        return;
+      }
     }
 
     if (!ValidatePrincipalCouldPotentiallyBeLoadedBy(
diff --git a/netwerk/ipc/DocumentLoadListener.cpp b/netwerk/ipc/DocumentLoadListener.cpp
index 9005281a3ae..845b82753d7 100644
--- a/netwerk/ipc/DocumentLoadListener.cpp
+++ b/netwerk/ipc/DocumentLoadListener.cpp
@@ -775,7 +775,9 @@ auto DocumentLoadListener::Open(nsDocShellLoadState* aLoadState,
 
   if (aLoadState->GetRemoteTypeOverride()) {
     if (!mIsDocumentLoad || !NS_IsAboutBlank(aLoadState->URI()) ||
-        !loadingContext->IsTopContent()) {
+        !loadingContext->IsTopContent() ||
+        aLoadState->GetEffectiveTriggeringRemoteType() != NOT_REMOTE_TYPE ||
+        aLoadState->LoadIsFromSessionHistory()) {
       LOG(
           ("DocumentLoadListener::Open with invalid remoteTypeOverride "
            "[this=%p]",
Loading diff…