Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionMitigation bypass in the DOM: Copy & Paste and Drag & Drop component
ComponentDOM
Bug ClassLogic Error
Tracker2058417
Fix commit079a730afd38 (firefox) +6/-3
CISA KEVNot listed
Creditedanas cherni
Disclosed2026-09-15

Files Changed

  • dom/events/DataTransfer.cpp
diff --git a/dom/events/DataTransfer.cpp b/dom/events/DataTransfer.cpp
index 19b6b1c9476..fa929fc0009 100644
--- a/dom/events/DataTransfer.cpp
+++ b/dom/events/DataTransfer.cpp
@@ -950,16 +950,19 @@ nsresult DataTransfer::SetDataAtInternal(const nsAString& aFormat,
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
 
+  nsAutoString format;
+  GetRealFormat(aFormat, format);
+
   // Don't allow the custom type to be assigned.
-  if (aFormat.EqualsLiteral(kCustomTypesMime)) {
+  if (format.EqualsLiteral(kCustomTypesMime)) {
     return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
   }
 
-  if (!PrincipalMaySetData(aFormat, aData, aSubjectPrincipal)) {
+  if (!PrincipalMaySetData(format, aData, aSubjectPrincipal)) {
     return NS_ERROR_DOM_SECURITY_ERR;
   }
 
-  return SetDataWithPrincipal(aFormat, aData, aIndex, aSubjectPrincipal);
+  return SetDataWithPrincipal(format, aData, aIndex, aSubjectPrincipal);
 }
 
 void DataTransfer::MozSetDataAt(JSContext* aCx, const nsAString& aFormat,
Loading diff…