1984940 - (CVE-2025-13018) window.open() with `noreferrer` incorrectly sends "Sec-Fetch-Site: none"

Status: VERIFIED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Daniel Veditz [:dveditz]]

Attachment: sec-fetch-site.html

Navigations should only have Sec-Fetch-Site: none if the navigation was due to the user interacting with the browser UI itself (e.g. Bookmarks, typing in the address bar). Any navigation that originated in another web page should get the appropriate cross-origin/same-site/same-origin value depending on the relationship between the two origins. Even if it was user-initiated, even from the right-click context menu, the URL used in the navigation is under the control of the web page and could obfuscate its destination in many ways.

This works correctly in lots of variations, but not when using a window.open() that includes noreferrer in the windowFeatures argument. In that case we incorrectly send Sec-Fetch-Site: none which implies (to the remote server) that the user opened this URL on their own and it was not an attack.

STR:

1. open the sec-fetch-site testcase
2. click the noreferrer window.open() link (marked BUG)

Actual results: new tab showing request headers, including Sec-Fetch-Site: none

Expected results: should have matched the plain window.open() and _blank noreferrer link results, with Sec-Fetch-Site: cross-origin

Comment 1

[Simon Friedberger [:simonf]]

IsUserTriggeredForSecFetchSite wants to look at the OriginalReferrer but the ReferrerInfo on the Channel is NULL.

Comment 2

[Simon Friedberger [:simonf]]

Attachment: (secure)

Comment 3

[Simon Friedberger [:simonf]]

Attachment: (secure)

Comment 4

[Simon Friedberger [:simonf]]

Attachment: (secure)

Comment 5

[Simon Friedberger [:simonf]]

Comment on attachment 9514903 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Trivially
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Yes
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: All, the code is pretty old
• If not all supported branches, which bug introduced the flaw?: Bug 1508292
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?: Easy, but there is some web compat risk. The code is brittle and the spec is still a draft and does not exactly specify the behavior under discussion.
• How likely is this patch to cause regressions; how much testing does it need?: Hopefully, the existing WPTs at https://wpt.fyi/results/fetch/metadata?label=experimental&label=master&aligned would catch any issues.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Unknown

Comment 6

[Simon Friedberger [:simonf]]

Comment on attachment 9514904 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: See other patch
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Yes
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?:
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?:
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 7

[Tom Ritter [:tjr]]

Comment on attachment 9514903 [details]
(secure)

Clearing approval for test

Comment 8

[Tom Ritter [:tjr]]

Comment on attachment 9514904 [details]
(secure)

Approved to land and request uplift

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Given the moderate sec rating and higher regression risk, I'm don't think this is worth uplifting to ESR115. LMK if you strongly disagree.

Comment 10

[BugBot [:suhaib / :marco]]

The bug is marked as tracked for firefox144 (beta) and tracked for firefox145 (nightly). However, the bug still has low severity.

:freddy, could you please increase the severity for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/1fc7a056fb5f
https://hg.mozilla.org/integration/autoland/rev/936ab378358d
Make sec-fetch user-triggered check default to secure r=ckerschb

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/936ab378358d

Comment 13

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:simonf, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox144 to wontfix.

For more information, please visit BugBot documentation.

Comment 14

[Simon Friedberger [:simonf]]

I think we should give this some time to bake.

Comment 15

[Ciprian Georgiu, Desktop QA]

I've repro this issue with STR from comment 0 on an affected Nightly (2025-08-24) running Win 11.

The issue is verified as fixed on Beta 145.0b2 under Win 11, macOS 15 and Ubuntu 24.

Comment 16

[Ryan VanderMeulen [:RyanVM]]

Is this ready for an ESR140 approval request?

Comment 17

[Simon Friedberger [:simonf]]

Attachment: (secure)

Comment 18

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined: sec-moderate security issue
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Has been riding the trains and is hitting release soon.
• String changes made/needed: No
• Is Android affected?: yes

Comment 19

[Simon Friedberger [:simonf]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D265744

Comment 20

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/4dcda609c702

Comment 21

[Ciprian Georgiu, Desktop QA]

This is also verified as fixed on 140.5.0esr with Win 11, macOS 28 and Ubuntu 24.04.

Comment 22

[Tom Schuster [:tschuster]]

Attachment: advisory.txt

Comment 23

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/7d063ed67418
https://hg.mozilla.org/integration/autoland/rev/fd9556f20459
Add test case r=ckerschb,frontend-codestyle-reviewers,mossop

Comment 24

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/455c0de73e06
https://hg.mozilla.org/integration/autoland/rev/481b57e9970c
Revert "Bug 1984940: Add test case r=ckerschb,frontend-codestyle-reviewers,mossop" for causing mochitest failures @ test_noreferrer_popup.html

Comment 25

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

• Push with failures
• Failure log

[task 2025-11-18T12:23:25.274+00:00] 12:23:25     INFO - PID 22003 | ThreadSanitizer: CHECK failed: sanitizer_deadlock_detector1.cpp:166 "((!dd.isHeld(&lt->dd, m->id))) != (0)" (0x0, 0x0) (tid=23349)
[taskcluster 2025-11-18T12:24:19.417Z] [taskcluster-proxy] Successfully refreshed taskcluster-proxy credentials: task-client/WvHv05SaSu-ag0Wqy3tNNw/0/on/us-central1-f/6376642826812382862/until/1763469859.36
[task 2025-11-18T12:26:23.086+00:00] 12:26:23     INFO - TEST-UNEXPECTED-TIMEOUT | /webdriver/tests/bidi/network/set_extra_headers/headers_name_standard_tentative.py | expected OK

Comment 26

[BugBot [:suhaib / :marco]]

2 months ago, tjr placed a reminder on the bug using the whiteboard tag [reminder-test 2025-11-25] .

simonf, please refer to the original comment to better understand the reason for the reminder.

Comment 27

[Simon Friedberger [:simonf]]

This is still broken on Android without fission. AFAIU that is not something that we need to support so I am disabling the test for this case.

Comment 28

[Phabricator Automation]

Comment on attachment 9514903 [details]
(secure)

Revision D265743 was moved to bug 1987940. Setting attachment 9514903 [details] to obsolete.

Comment 29

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/af36baaea5b3
https://hg.mozilla.org/integration/autoland/rev/32fdaea74b34
Add test case r=ckerschb,frontend-codestyle-reviewers,mossop

Comment 30

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/32fdaea74b34