Firefox · DOM
CVE-2026-8401
Sandbox Escape in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/ipc/jsactor/JSActorService.cpp |
modified | |
fordom/ipc/jsactor/JSActorService.cpp |
modified |
Files Changed
browser/components/DesktopActorRegistry.sys.mjsbrowser/components/migration/MigrationUtils.sys.mjsdom/ipc/jsactor/JSActorService.cpp
Patch
diff --git a/browser/components/DesktopActorRegistry.sys.mjs b/browser/components/DesktopActorRegistry.sys.mjs
index 6947afcd0cd..767ec1ea679 100644
--- a/browser/components/DesktopActorRegistry.sys.mjs
+++ b/browser/components/DesktopActorRegistry.sys.mjs
@@ -298,6 +298,7 @@ let JSWINDOWACTORS = {
"about:newtab*",
"about:home*",
],
+ remoteTypes: ["parent", "privilegedabout"],
},
BlockedSite: {
diff --git a/browser/components/migration/MigrationUtils.sys.mjs b/browser/components/migration/MigrationUtils.sys.mjs
index 06977053e16..c4eea345401 100644
--- a/browser/components/migration/MigrationUtils.sys.mjs
+++ b/browser/components/migration/MigrationUtils.sys.mjs
@@ -176,6 +176,7 @@ class MigrationUtils {
"chrome://browser/content/spotlight.html",
"about:firefoxview",
],
+ remoteTypes: ["parent", "privilegedabout"],
});
ChromeUtils.defineLazyGetter(this, "IS_LINUX_SNAP_PACKAGE", () => {
diff --git a/dom/ipc/jsactor/JSActorService.cpp b/dom/ipc/jsactor/JSActorService.cpp
index 91949b111af..f0d3a9b8839 100644
--- a/dom/ipc/jsactor/JSActorService.cpp
+++ b/dom/ipc/jsactor/JSActorService.cpp
@@ -341,6 +341,14 @@ bool JSActorProtocol::RemoteTypePrefixMatches(const nsACString& aRemoteType) {
}
nsDependentCSubstring remoteTypePrefix(RemoteTypePrefix(aRemoteType));
+
+ // The actual remote type for the parent process is the empty string, so
+ // change it to something we can actually match.
+ MOZ_ASSERT(!StringBeginsWith(remoteTypePrefix, "parent"_ns));
+ if (aRemoteType == NOT_REMOTE_TYPE) {
+ remoteTypePrefix.AssignLiteral("parent");
+ }
+
for (auto& remoteType : mRemoteTypes) {
// TODO: Maybe this should use glob-style matching instead. See bug 2006165.
if (StringBeginsWith(remoteTypePrefix, remoteType)) {
Loading diff…
References
On This Page