Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionMitigation bypass in the DOM: Security component
ComponentDOM
Bug ClassLogic Error
Tracker2031123
Fix commiteb5b634c606f (firefox) +8/-1
CISA KEVNot listed
CreditedAtsushi Sada
Disclosed2026-05-19

Changed Functions

FunctionChangeNotes
if
dom/worklet/WorkletThread.cpp
modified

Files Changed

  • dom/worklet/WorkletThread.cpp
diff --git a/dom/worklet/WorkletThread.cpp b/dom/worklet/WorkletThread.cpp
index 66ac2b27b59..bf530ef8b47 100644
--- a/dom/worklet/WorkletThread.cpp
+++ b/dom/worklet/WorkletThread.cpp
@@ -388,7 +388,14 @@ bool ContentSecurityPolicyAllows(
   bool reportViolation = false;
   if (OffThreadCSPContext* ctx = impl->GetCSPContext()) {
     if (aKind == JS::RuntimeCode::JS) {
-      *aOutCanCompileStrings = ctx->IsEvalAllowed(reportViolation);
+      if (ctx->CSPInfo().requireTrustedTypesForDirectiveState() ==
+          RequireTrustedTypesForDirectiveState::ENFORCE) {
+        // The TrustedTypePolicyFactory is not exposed to Worklets, so there is
+        // no way to define a policy that would allow scripts.
+        *aOutCanCompileStrings = false;
+      } else {
+        *aOutCanCompileStrings = ctx->IsEvalAllowed(reportViolation);
+      }
     } else {
       *aOutCanCompileStrings = ctx->IsWasmEvalAllowed(reportViolation);
     }
Loading diff…