Firefox · DOM
CVE-2026-84140
Logic Error in DOM
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/ipc/ContentParent.cpp |
modified |
Files Changed
dom/ipc/ContentParent.cpp
Patch
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index d3973667268..6d418e60e28 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -7621,6 +7621,11 @@ mozilla::ipc::IPCResult ContentParent::RecvHistoryCommit(
return IPC_FAIL(
this, "Could not get canonical. aContext.get_canonical() fails.");
}
+
+ if (!canonical->IsOwnedByProcess(ChildID())) {
+ return IPC_OK();
+ }
+
canonical->SessionHistoryCommit(aLoadID, aChangeID, aLoadType,
aCloneEntryChildren, aChannelExpired,
aCacheKey);
@@ -7686,6 +7691,10 @@ mozilla::ipc::IPCResult ContentParent::RecvSessionHistoryEntryTitle(
return IPC_OK();
}
+ if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+ return IPC_OK();
+ }
+
SessionHistoryEntry* entry =
aContext.get_canonical()->GetActiveSessionHistoryEntry();
if (entry) {
@@ -7701,6 +7710,10 @@ ContentParent::RecvSessionHistoryEntryScrollRestorationIsManual(
return IPC_OK();
}
+ if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+ return IPC_OK();
+ }
+
SessionHistoryEntry* entry =
aContext.get_canonical()->GetActiveSessionHistoryEntry();
if (entry) {
@@ -7716,6 +7729,10 @@ mozilla::ipc::IPCResult ContentParent::RecvSessionHistoryEntryScrollPosition(
return IPC_OK();
}
+ if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+ return IPC_OK();
+ }
+
SessionHistoryEntry* entry =
aContext.get_canonical()->GetActiveSessionHistoryEntry();
if (entry) {
@@ -7731,6 +7748,10 @@ ContentParent::RecvSessionHistoryEntryStoreWindowNameInContiguousEntries(
return IPC_OK();
}
+ if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+ return IPC_OK();
+ }
+
// Per https://html.spec.whatwg.org/#history-traversal 4.2.1, we need to set
// the name to all contiguous entries. This has to be called before
// CanonicalBrowsingContext::SessionHistoryCommit(), so the active entry is
@@ -7754,6 +7775,10 @@ mozilla::ipc::IPCResult ContentParent::RecvSessionHistoryEntryCacheKey(
return IPC_OK();
}
+ if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+ return IPC_OK();
+ }
+
SessionHistoryEntry* entry =
aContext.get_canonical()->GetActiveSessionHistoryEntry();
if (entry) {
@@ -7770,7 +7795,7 @@ mozilla::ipc::IPCResult ContentParent::RecvSessionHistoryEntryWireframe(
}
BrowsingContext* bc = aContext.GetMaybeDiscarded();
- if (!bc) {
+ if (!bc || !bc->Canonical()->IsOwnedByProcess(ChildID())) {
return IPC_OK();
}
@@ -7807,6 +7832,10 @@ mozilla::ipc::IPCResult ContentParent::RecvSynchronizeNavigationAPIState(
return IPC_OK();
}
+ if (!aContext.get_canonical()->IsOwnedByProcess(ChildID())) {
+ return IPC_OK();
+ }
+
aContext.get_canonical()->SynchronizeNavigationAPIState(aState);
return IPC_OK();
}
@@ -7894,7 +7923,7 @@ mozilla::ipc::IPCResult ContentParent::RecvHistoryReload(
const uint32_t aReloadFlags) {
if (!aContext.IsNullOrDiscarded()) {
RefPtr<CanonicalBrowsingContext> canonical = aContext.get_canonical();
- if (!canonical->Top()->IsKnownInSubTree(ChildID())) {
+ if (!canonical->IsOwnedByProcess(ChildID())) {
return IPC_OK();
}
Loading diff…
References
On This Page