1970997 - (CVE-2025-8039) sometimes the search term persists in the url bar

Status: VERIFIED FIXED

(Firefox :: Address Bar, defect, P2)

Description

[Sören Hentzschel]

Attachment: screenshot

if you look at the screenshot, you can see that the Google logo and the search term are in the address bar, even though a Non-Google website is loaded (it was the result of a Google search). Normally this should not happen, especially since it can also be seen as a security issue if the URL of an arbitrary website is not visible.

In most cases, the described behavior does not happen. However, this has now happened to me for the second time within a few days (on different devices each time).

Firefox Nightly 141.0a1 (2025-06-06) on macOS 15.5.

Comment 1

[Drew Willcoxon :adw]

This is pretty bad from a security standpoint. James, would you be able to take a look?

Comment 2

[James Teow [:jteow]]

Thanks for flagging, I'll prioritize investigating this first thing next week.

Comment 3

[James Teow [:jteow]]

Attachment: Bug 1970997 - Add origin validation check for persisted search terms - r?#urlbar-reviewers!

Unable to reproduce the original issue, but adding a safeguard
to ensure search terms only persist when the current URI matches
the URI that was used to load the page.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/a34b558392eb
https://hg.mozilla.org/integration/autoland/rev/c284d56dbb98
Add origin validation check for persisted search terms - r=urlbar-reviewers,mak

Comment 5

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/c284d56dbb98

Comment 6

[Ardelean Oana, Desktop Test Engineering [:oardelean]]

I managed to reproduce the issue once on a 2025-06-06 Firefox Nightly build, using the string from the screenshot in Comment 0. Reproduced on macOS 15.
Verified as fixed on Firefox Nightly 142.0a1 and Firefox 141.0b1 on Windows 10, Ubuntu 22, macOS 15.

Comment 7

[Marco Bonardo [:mak]]

we should uplift this to ESR140, I think.

Comment 8

[James Teow [:jteow]]

Comment on attachment 9495179 [details]
Bug 1970997 - Add origin validation check for persisted search terms - r?#urlbar-reviewers!

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: It could be confusing for users for the search terms to persist on non-search engine results pages.
• User impact if declined: Intermittently, they might see the search terms persist in the address bar on a non search results page.
• Fix Landed on Version: 141
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): It's limited to the address bar feature that operates on search engine results pages. There are also automated tests.

Comment 9

[Daniel Veditz [:dveditz]]

For clarity, "status-firefox140: wontfix" means we don't want to ship a 140.0.x point release for this. We do still want the uplift to make "status-firefox-esr140" fixed (tracking "141+" means "the ESR release in the 141 cycle", that is, 140.1)

Comment 10

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/a4d7f3ade6c3

Comment 11

[Simon Friedberger [:simonf]]

Attachment: advisory.txt

Comment 12

[Ardelean Oana, Desktop Test Engineering [:oardelean]]

Verified as fixed on Firefox 140.1esr on Windows 10, Ubuntu 22, macOS 13.

Comment 13

[Simon Friedberger [:simonf]]

Attachment: advisory.txt