Closed
Bug 2015365
Opened 5 months ago
Closed 5 months ago
Compromised content process adds permanent TLS cert overrides for arbitrary domains via RecvAddCertException IPC — zero validation enables silent MITM
Categories
(Core :: DOM: Content Processes, defect)
Core
DOM: Content Processes
Tracking
()
RESOLVED
DUPLICATE
of bug 2013800
People
(Reporter: kerberoasting, Unassigned)
Details
(Keywords: ai-involved, reporter-external, Whiteboard: [client-bounty-form])
Attachments
(1 file)
|
5.84 KB,
text/markdown
|
Details |
ContentParent::RecvAddCertException (ContentParent.cpp:6550) passes attacker-supplied hostname, port, and certificate directly to RememberValidityOverride() with zero validation, writing permanent cert overrides to disk for any domain.
The JS API is properly gated (CallerIsTrustedAboutCertError, host/port/cert from mFailedChannel). The IPC handler has none of these protections.
A compromised content process can silently pre-stage permanent TLS MITM for any domain. Overrides persist across restarts in cert_override.txt. No user notification.
Full trace, PoC, and fix in attached submission_certoverride.md. Distilled down to reduce noise. Thanks!
Flags: sec-bounty?
|
||
Updated•5 months ago
|
Group: firefox-core-security → dom-core-security
Component: Security → DOM: Content Processes
Product: Firefox → Core
|
||
Updated•5 months ago
|
Status: UNCONFIRMED → RESOLVED
Closed: 5 months ago
Duplicate of bug: CVE-2026-16372
Keywords: ai-involved
Resolution: --- → DUPLICATE
|
||
Updated•5 months ago
|
Flags: sec-bounty? → sec-bounty-
|
|
||
Updated•2 months ago
|
Group: dom-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•