2007302 - (CVE-2026-24868) CSP strict-dynamic bypass via shimmed Disqus embed code

Status: VERIFIED FIXED

(Core :: Privacy: Anti-Tracking, defect, P1)

Description

[Masato Kinugawa]

Attachment: fx_csp_bypass_strict-dynamic_disqus.html

Summary

This is a similar bug to Bug 1909241. When Firefox's Strict Enhanced Tracking Protection is enabled, certain tracking contents are shimmed.
Disqus embed code is one of them. When Firefox detects the Disqus embed code, loading is blocked until the user explicitly allows it. This unblocking process can be abused to bypass CSP strict-dynamic. It allows an attacker to execute arbitrary JavaScript even if the page has strict CSP rules.

Steps to reproduce

1. Open https://vulnerabledoma.in/fx_csp_bypass_strict-dynamic_disqus.html with Strict Enhanced Tracking Protection enabled. This page contains strict CSP rules:

<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'nonce-random' 'strict-dynamic';  [...]">

2. Click on the Allow on vulnerabledoma.in button.
3. Click on the Allow Disqus toggle button. An alert dialog will pop up.

Root cause

This querySelector call incorrectly selects a non-Disqus script:
https://searchfox.org/firefox-main/rev/2fd8beb47a8fd1a767e35a987dff4e0ec2536245/browser/extensions/webcompat/shims/disqus-embed.js#13-15
In the PoC case, <script src="data:,alert(document.domain)//.disqus.com/embed.js"></script> is retrieved wrongly.

After loading is allowed via the toggle button, the script is loaded via the following createElement(), bypassing strict-dynamic:
https://searchfox.org/firefox-main/rev/2fd8beb47a8fd1a767e35a987dff4e0ec2536245/browser/extensions/webcompat/lib/smartblock_embeds_helper.js#52-58

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1965307

:emz, since you are the author of the regressor, bug 1965307, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 2

[Emma Zühlcke [:emz]]

I can reproduce. To address this we most likely want to properly inspect the src value using JS. We can parse it as a URL first and then do checks on it. We could make the query selector more strict, but that could be bypassed too.

Comment 3

[Tom Schuster (Away Aug 14 - Aug 31)]

We shouldn't even be looking at the wrong script URLs of course, but we could also think about injecting the scripts in a way that the page's CSP (and other policies like the Integrity-Policy) apply.

Edit: Actually this might be complicated for cases where the original script tag has a nonce.

Comment 4

[Emma Zühlcke [:emz]]

(In reply to Tom Schuster (MoCo) [PTO Dec 23 - Jan 4] from comment #3)

We shouldn't even be looking at the wrong script URLs of course, but we could also think about injecting the scripts in a way that the page's CSP (and other policies like the Integrity-Policy) apply.

Right, so I'm surprised that injecting the script like here: https://searchfox.org/firefox-main/rev/2fd8beb47a8fd1a767e35a987dff4e0ec2536245/browser/extensions/webcompat/lib/smartblock_embeds_helper.js#52-58 doesn't enforce CSP. It's possible that the comment about the principal is wrong.

Comment 5

[Emma Zühlcke [:emz]]

Attachment: (secure)

Comment 6

[Emma Zühlcke [:emz]]

I've attached a patch that is more strict about which script URIs it picks. We should also fix the CSP bypass issue itself, I'm still looking into that.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c7e967b6d888
https://hg.mozilla.org/integration/autoland/rev/14b5087b315f
r=webcompat-reviewers,bvandersloot,twisniewski

Comment 8

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/mozilla-central/rev/14b5087b315f

Comment 9

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:emz, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox147 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[Emma Zühlcke [:emz]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D277442

Comment 11

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Sites can trick Firefox into injecting custom scripts (via our shim embed logic) which bypasses strict-dynamic CSP.
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: See https://bugzilla.mozilla.org/show_bug.cgi?id=2007302#c0
• Risk associated with taking this patch: low
• Explanation of risk level: Fairly small code change. The updated code only runs when tracking protection is enabled and when the user visits a site with Disqus embeds.
• String changes made/needed: no
• Is Android affected?: yes

Comment 12

[Ciprian Georgiu, Desktop QA]

I've repro this issue with the STR from comment 0, on an affected Nightly build (2025-12-21).

The issue is verified as fixed on latest Nightly 148.0a1 under Win 11, macOS 26.1 and Ubuntu 24.04.

Comment 13

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/6b1bd7412f22
https://hg.mozilla.org/releases/mozilla-release/rev/6f0508b407c9

Comment 14

[Ciprian Georgiu, Desktop QA]

This bug is also verified as fixed on Firefox 147.0.2 under Win 11, macOS 26 and Ubuntu 24.