2013017 - WindowGlobalParent::RecvLoadURI and RecvInternalLoad missing CanAccess() validation allows unauthorized cross-process navigation

Status: RESOLVED DUPLICATE of bug 2010310

(Core :: DOM: Navigation, defect)

Description

[Aswin]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36

Steps to reproduce:

Analyzed WindowGlobalParent IPC handlers in dom/ipc/WindowGlobalParent.cpp

RecvLoadURI (line 319) and RecvInternalLoad (line 349) allow loading URIs
into target BrowsingContexts with only a Group check, not a CanAccess() check.

Developer FIXME comments explicitly acknowledge missing validation:

Line 337: "FIXME: For cross-process loads, we should double check CanAccess()
for the source browsing context in the parent process."

Line 369: Same FIXME comment.

Actual results:

The parent process validates that target BrowsingContext is in the same Group,
but does NOT validate CanAccess() for cross-process loads.

Vulnerable code (RecvLoadURI line 335-342):

RefPtr<CanonicalBrowsingContext> targetBC = aTargetBC.get_canonical();

// FIXME: For cross-process loads, we should double check CanAccess()
if (targetBC->Group() != BrowsingContext()->Group()) {
return IPC_FAIL(this, "Illegal cross-group BrowsingContext load");
}
targetBC->LoadURI(aLoadState, aSetNavigating); // No CanAccess() check!

A compromised content process can trigger navigation in BrowsingContexts
it should not have access to, as long as they're in the same Group.

Being in the same BrowsingContextGroup does not mean CanAccess() would return true.
Cross-origin iframes are in the same group but should not be navigable by each other.

Root Cause: Missing CanAccess() validation as noted by developer FIXME.

Expected results:

Parent process should validate CanAccess() before allowing cross-process loads.

The FIXME comment indicates the intended fix:

if (!sourceBC->CanAccess(targetBC)) {
return IPC_FAIL(this, "Source cannot access target BrowsingContext");
}

This would prevent unauthorized cross-origin navigation within the same BrowsingContextGroup.

Comment 1

[Andrew McCreight [:mccr8]]

Dupe of bug 2010310, maybe.