Firefox · DOM
CVE-2026-84136
Logic Error in DOM
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/ipc/ContentParent.cpp
Patch
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index c6b9c9e3fe9..62cab1bcad0 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -7474,6 +7474,10 @@ mozilla::ipc::IPCResult ContentParent::RecvHistoryGo(
bool aCheckForCancelation, HistoryGoResolver&& aResolveRequestedIndex) {
if (!aContext.IsNullOrDiscarded()) {
RefPtr<CanonicalBrowsingContext> canonical = aContext.get_canonical();
+ if (!canonical->IsOwnedByProcess(ChildID())) {
+ return IPC_OK();
+ }
+
aResolveRequestedIndex(canonical->HistoryGo(
aOffset, aHistoryEpoch, aRequireUserInteraction, aUserActivation,
aCheckForCancelation, Some(ChildID())));
@@ -7487,6 +7491,10 @@ mozilla::ipc::IPCResult ContentParent::RecvNavigationTraverse(
NavigationTraverseResolver&& aResolver) {
if (!aContext.IsNullOrDiscarded()) {
RefPtr<CanonicalBrowsingContext> canonical = aContext.get_canonical();
+ if (!canonical->IsOwnedByProcess(ChildID())) {
+ return IPC_OK();
+ }
+
canonical->NavigationTraverse(aKey, aHistoryEpoch, aUserActivation,
aCheckForCancelation, Some(ChildID()),
aResolver);
Loading diff…
References
On This Page