Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionSite isolation issue in the DOM: Navigation component
ComponentDOM
Bug ClassLogic Error
Tracker2063780
Fix commitf394de524959 (firefox) +31/-2
CISA KEVNot listed
CreditedMohamed Mbarek
Disclosed2026-09-01

Changed Functions

FunctionChangeNotes
if
dom/ipc/ContentParent.cpp
modified

Files Changed

  • dom/ipc/ContentParent.cpp
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index d3973667268..6d418e60e28 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -7621,6 +7621,11 @@ mozilla::ipc::IPCResult ContentParent::RecvHistoryCommit(
       return IPC_FAIL(
           this, "Could not get canonical. aContext.get_canonical() fails.");
     }
+
+    if (!canonical->IsOwnedByProcess(ChildID())) {
+      return IPC_OK();
+    }
+
     canonical->SessionHistoryCommit(aLoadID, aChangeID, aLoadType,
                                     aCloneEntryChildren, aChannelExpired,
                                     aCacheKey);
@@ -7686,6 +7691,10 @@ mozilla::ipc::IPCResult ContentParent::RecvSessionHistoryEntryTitle(
     return IPC_OK();
   }
 
+  if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+    return IPC_OK();
+  }
+
   SessionHistoryEntry* entry =
       aContext.get_canonical()->GetActiveSessionHistoryEntry();
   if (entry) {
@@ -7701,6 +7710,10 @@ ContentParent::RecvSessionHistoryEntryScrollRestorationIsManual(
     return IPC_OK();
   }
 
+  if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+    return IPC_OK();
+  }
+
   SessionHistoryEntry* entry =
       aContext.get_canonical()->GetActiveSessionHistoryEntry();
   if (entry) {
@@ -7716,6 +7729,10 @@ mozilla::ipc::IPCResult ContentParent::RecvSessionHistoryEntryScrollPosition(
     return IPC_OK();
   }
 
+  if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+    return IPC_OK();
+  }
+
   SessionHistoryEntry* entry =
       aContext.get_canonical()->GetActiveSessionHistoryEntry();
   if (entry) {
@@ -7731,6 +7748,10 @@ ContentParent::RecvSessionHistoryEntryStoreWindowNameInContiguousEntries(
     return IPC_OK();
   }
 
+  if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+    return IPC_OK();
+  }
+
   // Per https://html.spec.whatwg.org/#history-traversal 4.2.1, we need to set
   // the name to all contiguous entries. This has to be called before
   // CanonicalBrowsingContext::SessionHistoryCommit(), so the active entry is
@@ -7754,6 +7775,10 @@ mozilla::ipc::IPCResult ContentParent::RecvSessionHistoryEntryCacheKey(
     return IPC_OK();
   }
 
+  if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+    return IPC_OK();
+  }
+
   SessionHistoryEntry* entry =
       aContext.get_canonical()->GetActiveSessionHistoryEntry();
   if (entry) {
@@ -7770,7 +7795,7 @@ mozilla::ipc::IPCResult ContentParent::RecvSessionHistoryEntryWireframe(
   }
 
   BrowsingContext* bc = aContext.GetMaybeDiscarded();
-  if (!bc) {
+  if (!bc || !bc->Canonical()->IsOwnedByProcess(ChildID())) {
     return IPC_OK();
   }
 
@@ -7807,6 +7832,10 @@ mozilla::ipc::IPCResult ContentParent::RecvSynchronizeNavigationAPIState(
     return IPC_OK();
   }
 
+  if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+    return IPC_OK();
+  }
+
   aContext.get_canonical()->SynchronizeNavigationAPIState(aState);
   return IPC_OK();
 }
@@ -7894,7 +7923,7 @@ mozilla::ipc::IPCResult ContentParent::RecvHistoryReload(
     const uint32_t aReloadFlags) {
   if (!aContext.IsNullOrDiscarded()) {
     RefPtr<CanonicalBrowsingContext> canonical = aContext.get_canonical();
-    if (!canonical->Top()->IsKnownInSubTree(ChildID())) {
+    if (!canonical->IsOwnedByProcess(ChildID())) {
       return IPC_OK();
     }
 
Loading diff…