Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionMitigation bypass in the Networking component
ComponentDOM
Bug ClassLogic Error
Tracker2063814
Fix commit641d322ce937 (firefox) +7/-1
CISA KEVNot listed
CreditedTakeshi Kaneko
Disclosed2026-09-15

Changed Functions

FunctionChangeNotes
if
dom/base/MimeType.cpp
modified

Files Changed

  • dom/base/MimeType.cpp
diff --git a/dom/base/MimeType.cpp b/dom/base/MimeType.cpp
index 934512a1193..1dba5b852ae 100644
--- a/dom/base/MimeType.cpp
+++ b/dom/base/MimeType.cpp
@@ -252,7 +252,13 @@ TMimeType<char_type>::SplitMimetype(const nsTSubstring<char_type>& aMimeType) {
   for (size_t i = 0; i < aMimeType.Length(); i++) {
     char_type c = aMimeType[i];
 
-    if (c == '\"' && (i == 0 || aMimeType[i - 1] != '\\')) {
+    // https://fetch.spec.whatwg.org/#collect-an-http-quoted-string : a
+    // backslash only escapes inside a quoted string, and it consumes the code
+    // point that follows it, so an escaped backslash does not escape the next
+    // character.
+    if (inQuotes && c == '\\') {
+      ++i;
+    } else if (c == '"') {
       inQuotes = !inQuotes;
     } else if (c == ',' && !inQuotes) {
       mimeTypeParts.AppendElement(Substring(aMimeType, start, i - start));
Loading diff…