2023753 - (CVE-2026-6769) DevTools Debugger Quick Open renders source filenames as raw HTML into the privileged chrome:// context (scripting prevented by CSP)

Status: RESOLVED FIXED

(DevTools :: Debugger, defect, P2)

Description

[Tomoya Nakanishi]

Attachment: devtools-html-injection.mp4

Platform: Desktop (Windows)
Version: 150.0a1 (2026-03-16)

Firefox DevTools does not HTML-escape source file names before rendering them in the Debugger's Quick Open modal (Ctrl+P). A page under inspection can craft a //# sourceURL= pragma whose filename segment contains arbitrary HTML tags, which are then injected into chrome://devtools/content/debugger/index.html via dangerouslySetInnerHTML and executed in the privileged DevTools document.

As a concrete example, embedding a <style> tag in the filename causes the enclosed CSS to take effect inside the DevTools document. The PoC below injects a full-screen overlay that covers the entire DevTools window as soon as a developer searches for "overlay" in Quick Open.

Steps to Reproduce:

1. Serve poc.html below on any local HTTP server (e.g. python3 -m http.server 8000).
2. Open Firefox and navigate to http://localhost:8000/poc.html.
3. Open DevTools (F12) and select the Debugger panel.
4. Press Ctrl+P to open Quick Open.
5. Type overlay in the search box.
6. Observe that the entire DevTools window is covered by a full-screen overlay bearing the text "DevTools-Hijacked".

Security Impact:
A web page being actively inspected by a developer can inject arbitrary CSS into the privileged DevTools document without any user gesture beyond opening Quick Open. Concrete impacts include:

• Full-screen overlay impersonating Firefox security dialogs, enabling social-engineering attacks against developers.
• Complete concealment of Quick Open results (display:none) preventing a security auditor from finding any source files.

The DevTools CSP (default-src chrome:; style-src 'unsafe-inline') blocks inline script execution and external network requests, so direct JavaScript execution and data exfiltration are not achievable. However, full visual control over the DevTools UI is sufficient to deceive developers and interfere with security audits.

PoC:

poc.html:

<!DOCTYPE html>
<html>
<head><title>PoC</title></head>
<body>
<p>Open DevTools (F12) &rarr; Debugger &rarr; Ctrl+P &rarr; type "overlay".</p>
<script>
const PAYLOAD =
  "<style>" +
  "body::after{" +
  "content:'DevTools-Hijacked';" +
  "position:fixed;top:0;left:0;right:0;bottom:0;" +
  "z-index:2147483647;" +
  "background:rgba(30,31,40,.97);" +
  "color:rgb(255,85,85);" +
  "font-size:22px;line-height:2;font-family:monospace;" +
  "display:flex;align-items:center;justify-content:center;" +
  "text-align:center;white-space:pre" +
  "}" +
  "overlay.js";
const s = document.createElement("script");
s.textContent = "//# sourceURL=http://localhost:3000/poc/" + PAYLOAD;
document.body.appendChild(s);
</script>
</body>
</html>

Comment 1

[Daniel Veditz [:dveditz]]

Attachment: poc.html from comment 0

Comment 2

[Julian Descottes [:jdescottes]]

Bomsy, can you file a bug also to remove remaining usage of dangerouslySetInnerHTML in devtools?

Comment 4

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

This removes the logic used to try highlighting the part of the
source file name which matches the query text (typed into the quick
open) by injecting html into the title.

This all depends on the use of dangerouslySetInnerHTML, which added a
security risk.

Ironically the title property does not support styling anyways so all
this was not really neccesary.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/b6f6feefc897
https://hg.mozilla.org/integration/autoland/rev/c1277443cc7a
[devtools] Remove the use of dangerouslySetInnerHTML in the Quickopen panel  r=devtools-reviewers,nchevobbe,frontend-codestyle-reviewers

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/c1277443cc7a

Comment 7

[Daniel Veditz [:dveditz]]

We are awarding a split bounty between this and bug 2024531 which were both filed within our collision window.

Comment 8

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:bomsy, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox150 to wontfix.

For more information, please visit BugBot documentation.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Also ESR140 if possible.

Comment 10

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: Potential to hijack devtools leveraging the //@ sourceURL
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: javascript fix
• String changes made/needed?: None
• Is Android affected?: yes

Comment 11

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D288642

Comment 12

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined/Reason for urgency: Potential to hijack devtools leveraging the //@ sourceURL
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: javascript fix
• String changes made/needed?: None
• Is Android affected?: yes

Comment 13

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D288642

Comment 14

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/e794d098ce49
https://hg.mozilla.org/releases/mozilla-beta/rev/df2cfd121c53

Comment 15

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/49de4134fe63

Comment 16

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/09d087599641

Comment 17

[Goloman Adrian[:agoloman]]

Backed out from ESR140 for causing dt failure @browser_dbg-quick-open.js

• Backout link
• Push with failures
• Failure Log

Comment 18

[Hubert Boma Manilla (:bomsy)]

So it looks like the Sanitizer API is not supported in ESR. i'll do a fix

Comment 19

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D288642

Comment 20

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined/Reason for urgency: Devtools can be hijacked leveraging th //@sourceUrl
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Js fix using new Web API
• String changes made/needed?: none
• Is Android affected?: yes

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/26e8db21463f