2031064 - (CVE-2026-8955) `EventSource` in Web Workers bypasses the `connect-src` CSP directive

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[lebr0nli (Alan Li) [:lebr0nli]]

Attachment: server.py

VULNERABILITY DETAILS

CSP is not properly enforced when instantiating an EventSource within a Web Worker. This allows an attacker to bypass the restrictive connect-src directive and establish connections to arbitrary URLs with EventSource.

VERSION

Firefox Version: 149.0.2 stable

The vulnerability is also present in Firefox 151.0a1 nightly

REPRODUCTION CASE

Steps to reproduce

1. Run the attached server.py with python3 server.py to start the local server.
2. Navigate to either http://127.0.0.1:1337/?blob or http://127.0.0.1:1337/?worker.js in the browser. This will trigger the page to spawn a Web Worker using either a Blob URL or the worker.js script.
3. The worker will attempt to establish an EventSource connection to http://127.0.0.1:1337/bypass?blob or http://127.0.0.1:1337/bypass?worker.js.

Expected results

The connection should be blocked by the connect-src 'none' CSP.

Actual results

The connection is successfully established.

CREDIT INFORMATION

Reporter credit: lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS, Security and Systems Lab.

Comment 1

[Tom Schuster]

I believe this is another instance of a channel being created without an appropriate ClientInfo being passed: https://searchfox.org/firefox-main/rev/6925ce3cf2987bec22cae8a32e1e8a57e49efd3b/dom/base/EventSource.cpp#1038-1046

Comment 2

[Tom Schuster]

Attachment: (secure)

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/14d1a3af3904
https://hg.mozilla.org/integration/autoland/rev/18e043f17abd
Use ClientInfo when creating EventSource. r=asuth,dom-worker-reviewers

Comment 4

[Donal Meehan [:dmeehan]]

https://hg-edge.mozilla.org/mozilla-central/rev/18e043f17abd

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR140 uplift when you have a chance.

Comment 6

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined/Reason for urgency: A web security feature CSP could be bypassed and unexpected requests could happen.
• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Simple and the normal tests for EventSource in Worker continue to pass.
• String changes made/needed?: no
• Is Android affected?: yes

Comment 7

[Tom Schuster]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D293841

Comment 8

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/4f1cc705f7d9