Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionInformation disclosure in the DOM: Push Subscriptions component
ComponentDOM
Bug ClassLogic Error
Tracker2059053
Fix commit64633df4508e (firefox) +10/-11
CISA KEVNot listed
CreditedKagami Rosylight
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
if
dom/push/PushManager.cpp
modified

Files Changed

  • dom/push/PushManager.cpp
  • testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini
diff --git a/dom/push/PushManager.cpp b/dom/push/PushManager.cpp
index 3deff5ec077..caba571b0c1 100644
--- a/dom/push/PushManager.cpp
+++ b/dom/push/PushManager.cpp
@@ -215,6 +215,7 @@ class GetSubscriptionRunnable final : public Runnable {
     AssertIsOnMainThread();
 
     nsCOMPtr<nsIPrincipal> principal;
+    nsCOMPtr<nsIPrincipal> effectiveStoragePrincipal;
 
     {
       // Bug 1228723: If permission is revoked or an error occurs, the
@@ -226,6 +227,7 @@ class GetSubscriptionRunnable final : public Runnable {
         return NS_OK;
       }
       principal = mProxy->GetWorkerPrivate()->GetPrincipal();
+      effectiveStoragePrincipal = mProxy->GetWorkerPrivate()->GetEffectiveStoragePrincipal();
     }
 
     MOZ_ASSERT(principal);
@@ -233,11 +235,13 @@ class GetSubscriptionRunnable final : public Runnable {
     RefPtr<GetSubscriptionCallback> callback =
         new GetSubscriptionCallback(mProxy, mScope);
 
-    PermissionState state;
-    nsresult rv = GetPermissionState(principal, state);
-    if (NS_FAILED(rv)) {
-      callback->OnPushSubscriptionError(NS_ERROR_FAILURE);
-      return NS_OK;
+    PermissionState state = PermissionState::Denied;
+
+    if (effectiveStoragePrincipal->OriginAttributesRef().mPartitionKey.IsEmpty()) {
+      if (NS_FAILED(GetPermissionState(principal, state))) {
+        callback->OnPushSubscriptionError(NS_ERROR_FAILURE);
+        return NS_OK;
+      }
     }
 
     if (state != PermissionState::Granted) {
@@ -256,6 +260,7 @@ class GetSubscriptionRunnable final : public Runnable {
       return NS_OK;
     }
 
+    nsresult rv;
     if (mAction == PushManager::SubscribeAction) {
       if (mAppServerKey.IsEmpty()) {
         rv = service->Subscribe(mScope, principal, callback);
diff --git a/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini b/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini
deleted file mode 100644
index 9b31f82ff3a..00000000000
--- a/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[cross-origin-nested.tentative.https.sub.window.html]
-  [third party worker]
-    expected: FAIL
-
-  [nested first party worker]
-    expected: FAIL
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini b/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini
deleted file mode 100644
index 9b31f82ff3a..00000000000
--- a/testing/web-platform/meta/push-api/cross-origin-nested.tentative.https.sub.window.js.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[cross-origin-nested.tentative.https.sub.window.html]
-  [third party worker]
-    expected: FAIL
-
-  [nested first party worker]
-    expected: FAIL
Loading diff…