2034465 - Missing ValidatePrincipal in PContentPermissionRequest allows permission requests with forged principal for arbitrary origins

Status: RESOLVED DUPLICATE of bug 1501072

(Core :: DOM: Security, defect)

Description

[Tran Quac]

Attachment: poc-permission-request.cpp

Summary

AllocPContentPermissionRequestParent (ContentParent.cpp:5154) and RecvPContentPermissionRequestConstructor (ContentParent.cpp:5179) do not call ValidatePrincipal() on two IPC-received principals. A compromised content process forges a principal to request permissions (camera, microphone, geolocation, notifications) attributed to an arbitrary origin.

Root Cause

// dom/ipc/ContentParent.cpp:5154-5177 — NO ValidatePrincipal
PContentPermissionRequestParent*
ContentParent::AllocPContentPermissionRequestParent(
    const nsTArray<PermissionRequest>& aRequests, nsIPrincipal* aPrincipal,
    nsIPrincipal* aTopLevelPrincipal, const bool& aIsHandlingUserInput,
    const bool& aMaybeUnsafePermissionDelegate, const TabId& aTabId) {
  // aPrincipal and aTopLevelPrincipal used directly, unvalidated
  return nsContentPermissionUtils::CreateContentPermissionRequestParent(
      tp->GetOwnerElement(), aPrincipal, topPrincipal, aIsHandlingUserInput,
      aMaybeUnsafePermissionDelegate, aTabId);
}

// dom/ipc/ContentParent.cpp:5179-5187 — NO ValidatePrincipal
mozilla::ipc::IPCResult ContentParent::RecvPContentPermissionRequestConstructor(
    PContentPermissionRequestParent* aActor,
    nsTArray<PermissionRequest>&& aRequests, nsIPrincipal* aPrincipal,
    nsIPrincipal* aTopLevelPrincipal, const bool& aIsHandlingUserInput,
    const bool& aMaybeUnsafePermissionDelegate, const TabId& tabId) {
  nsContentPermissionUtils::InitContentPermissionRequestParent(
      aActor, std::move(aRequests));
  return IPC_OK();
}

Both aPrincipal and aTopLevelPrincipal are from IPC. Neither the Alloc nor the Recv handler validates them.

aIsHandlingUserInput is a bool from the content process with no server-side verification.

What Gets Bypassed

Origin attribution: The permission request is attributed to whichever origin the forged principal represents. A content process for attacker.com can trigger a permission prompt that shows bank.com requesting camera access.

User gesture requirement: aIsHandlingUserInput=true (forged) may bypass user-gesture-gated permission flows, enabling auto-prompt or auto-grant paths depending on the permission type and existing site permissions.

Delegation check: aMaybeUnsafePermissionDelegate is attacker-controlled, potentially bypassing permission delegation security checks.

Impact

A compromised content process can:

• Spoof permission prompts — user sees "bank.com wants to use your camera" when it's actually attacker.com, leading to consent for the wrong origin
• Persist permissions for arbitrary origins — if user clicks "Allow", the permission is stored for the forged origin (e.g., bank.com), persisting across sessions and granting that origin permanent access
• Forge user gesture — aIsHandlingUserInput=true bypasses user-gesture requirements for permission prompts

Note: the permission prompt UI still appears and the user must click "Allow" for permissions to be granted. The core impact is origin spoofing — the user grants permission to an origin they did not intend.

Affected

Firefox Release, Beta, Nightly, ESR (all current). Verified on mozilla-firefox/firefox main HEAD 2026-04-23.

Suggested Fix

Add ValidatePrincipal in AllocPContentPermissionRequestParent with IPC_FAIL on failure. See attached diff.

URL

https://searchfox.org/mozilla-central/source/dom/ipc/ContentParent.cpp#5154

Comment 1

[Tran Quac]

Attachment: suggested-fix.diff