2034466 - RecvAddCertException allows compromised content process to add TLS certificate overrides for arbitrary hostnames (MITM enablement)

Status: RESOLVED DUPLICATE of bug 2013800

(Core :: DOM: Content Processes, defect)

Description

[Tran Quac]

Attachment: poc-cert-override.cpp

Summary

RecvAddCertException (ContentParent.cpp:6535) accepts hostname, port, and certificate directly from a content process with no authorization check. A compromised content process can add TLS certificate overrides for any hostname, enabling persistent MITM attacks against future connections.

Root Cause

// dom/ipc/ContentParent.cpp:6535-6549 — NO authorization check
mozilla::ipc::IPCResult ContentParent::RecvAddCertException(
    nsIX509Cert* aCert, const nsACString& aHostName, int32_t aPort,
    const OriginAttributes& aOriginAttributes, bool aIsTemporary,
    AddCertExceptionResolver&& aResolver) {
  nsCOMPtr<nsICertOverrideService> overrideService =
      do_GetService(NS_CERTOVERRIDE_CONTRACTID);
  if (!overrideService) {
    aResolver(NS_ERROR_FAILURE);
    return IPC_OK();
  }
  // aHostName, aPort, aCert all from content process — no validation
  nsresult rv = overrideService->RememberValidityOverride(
      aHostName, aPort, aOriginAttributes, aCert, aIsTemporary);
  aResolver(rv);
  return IPC_OK();
}

Normal flow: user encounters certificate error → error page shown → user clicks "Add Exception" → UI code calls this IPC. A compromised content process skips the UI entirely.

No check that:

• The content process is actually browsing aHostName
• The user interacted with a certificate error page
• aHostName matches the content process's origin

What Gets Bypassed

User consent: The entire certificate error page UI flow is bypassed. The user never sees a warning, never clicks "Add Exception", never confirms the override.

Origin restriction: A content process for attacker.com can add cert overrides for bank.com, mail.google.com, or any hostname.

Persistence: aIsTemporary=false (attacker-controlled) makes the override permanent, surviving browser restarts.

Impact

A compromised content process can:

• Enable MITM for any hostname — add cert override for bank.com, then a network attacker (public WiFi, compromised router) can intercept HTTPS connections with a self-signed cert that Firefox will trust
• Persistent damage — cert overrides with aIsTemporary=false persist across browser restarts, outlasting the content process compromise
• Silent mass targeting — add overrides for hundreds of high-value domains (banking, email, cloud providers) in a single pass, no user interaction

The attack chain: compromised content process adds cert overrides → user later connects to targeted site on compromised network → MITM succeeds silently because Firefox trusts the override. Full exploitation requires a second attacker with network position, but the persistent security-state corruption from the content process is the core vulnerability.

Affected

Firefox Release, Beta, Nightly, ESR (all current). Verified on mozilla-firefox/firefox main HEAD 2026-04-23.

Suggested Fix

Validate that the content process is currently browsing the hostname it's requesting a cert exception for, and verify that a user gesture occurred on a cert error page. See attached diff.

URL

https://searchfox.org/mozilla-central/source/dom/ipc/ContentParent.cpp#6535

Comment 1

[Tran Quac]

Attachment: suggested-fix.diff