Firefox · DOM
CVE-2026-8969
Logic Error in DOM
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/worklet/WorkletThread.cpp |
modified |
Files Changed
dom/worklet/WorkletThread.cpp
Patch
diff --git a/dom/worklet/WorkletThread.cpp b/dom/worklet/WorkletThread.cpp
index 66ac2b27b59..bf530ef8b47 100644
--- a/dom/worklet/WorkletThread.cpp
+++ b/dom/worklet/WorkletThread.cpp
@@ -388,7 +388,14 @@ bool ContentSecurityPolicyAllows(
bool reportViolation = false;
if (OffThreadCSPContext* ctx = impl->GetCSPContext()) {
if (aKind == JS::RuntimeCode::JS) {
- *aOutCanCompileStrings = ctx->IsEvalAllowed(reportViolation);
+ if (ctx->CSPInfo().requireTrustedTypesForDirectiveState() ==
+ RequireTrustedTypesForDirectiveState::ENFORCE) {
+ // The TrustedTypePolicyFactory is not exposed to Worklets, so there is
+ // no way to define a policy that would allow scripts.
+ *aOutCanCompileStrings = false;
+ } else {
+ *aOutCanCompileStrings = ctx->IsEvalAllowed(reportViolation);
+ }
} else {
*aOutCanCompileStrings = ctx->IsWasmEvalAllowed(reportViolation);
}
Loading diff…
References
On This Page