Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionPrivilege escalation in the Networking: Cookies component
ComponentDOM
Bug ClassLogic Error
Tracker2022382
Fix commit42be1ff328e7 (firefox) +4/-0
CISA KEVNot listed
CreditedSatoki Tsuji
Disclosed2026-08-18

Files Changed

  • dom/ipc/WindowGlobalParent.cpp
diff --git a/dom/ipc/WindowGlobalParent.cpp b/dom/ipc/WindowGlobalParent.cpp
index 891ad30aba6..b2b38aecb1e 100644
--- a/dom/ipc/WindowGlobalParent.cpp
+++ b/dom/ipc/WindowGlobalParent.cpp
@@ -1823,6 +1823,10 @@ IPCResult WindowGlobalParent::RecvSetCookies(
   NS_ENSURE_TRUE(csParent, IPC_OK());
   auto* cs = static_cast<net::CookieServiceParent*>(csParent);
 
+  if (!cs->ContentProcessHasCookie(aBaseDomain, aOriginAttributes)) {
+    return IPC_FAIL(this, "Invalid set-cookie request from content process");
+  }
+
   return cs->SetCookies(aBaseDomain, aOriginAttributes, aHost, aIsThirdParty,
                         aCookies, GetBrowsingContext());
 }
Loading diff…