High firefox Sandbox Escape 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape in the Profile Backup component
ComponentDOM
Bug ClassSandbox Escape
Tracker2038679
Fix commit0285defa00b4 (firefox) +10/-0
CISA KEVNot listed
Creditedggwhyp
Disclosed2026-05-12

Changed Functions

FunctionChangeNotes
if
dom/ipc/jsactor/JSActorService.cpp
modified
for
dom/ipc/jsactor/JSActorService.cpp
modified

Files Changed

  • browser/components/DesktopActorRegistry.sys.mjs
  • browser/components/migration/MigrationUtils.sys.mjs
  • dom/ipc/jsactor/JSActorService.cpp
diff --git a/browser/components/DesktopActorRegistry.sys.mjs b/browser/components/DesktopActorRegistry.sys.mjs
index 6947afcd0cd..767ec1ea679 100644
--- a/browser/components/DesktopActorRegistry.sys.mjs
+++ b/browser/components/DesktopActorRegistry.sys.mjs
@@ -298,6 +298,7 @@ let JSWINDOWACTORS = {
       "about:newtab*",
       "about:home*",
     ],
+    remoteTypes: ["parent", "privilegedabout"],
   },
 
   BlockedSite: {
diff --git a/browser/components/migration/MigrationUtils.sys.mjs b/browser/components/migration/MigrationUtils.sys.mjs
index 06977053e16..c4eea345401 100644
--- a/browser/components/migration/MigrationUtils.sys.mjs
+++ b/browser/components/migration/MigrationUtils.sys.mjs
@@ -176,6 +176,7 @@ class MigrationUtils {
         "chrome://browser/content/spotlight.html",
         "about:firefoxview",
       ],
+      remoteTypes: ["parent", "privilegedabout"],
     });
 
     ChromeUtils.defineLazyGetter(this, "IS_LINUX_SNAP_PACKAGE", () => {
diff --git a/dom/ipc/jsactor/JSActorService.cpp b/dom/ipc/jsactor/JSActorService.cpp
index 91949b111af..f0d3a9b8839 100644
--- a/dom/ipc/jsactor/JSActorService.cpp
+++ b/dom/ipc/jsactor/JSActorService.cpp
@@ -341,6 +341,14 @@ bool JSActorProtocol::RemoteTypePrefixMatches(const nsACString& aRemoteType) {
   }
 
   nsDependentCSubstring remoteTypePrefix(RemoteTypePrefix(aRemoteType));
+
+  // The actual remote type for the parent process is the empty string, so
+  // change it to something we can actually match.
+  MOZ_ASSERT(!StringBeginsWith(remoteTypePrefix, "parent"_ns));
+  if (aRemoteType == NOT_REMOTE_TYPE) {
+    remoteTypePrefix.AssignLiteral("parent");
+  }
+
   for (auto& remoteType : mRemoteTypes) {
     // TODO: Maybe this should use glob-style matching instead. See bug 2006165.
     if (StringBeginsWith(remoteTypePrefix, remoteType)) {
Loading diff…