2034493 - Race condition and insufficient principal validation in BackgroundParentImpl::RecvPBroadcastChannelConstructor enables cross-origin BroadcastChannel injection

Status: RESOLVED DUPLICATE of bug 2016925

(Core :: DOM: postMessage, defect)

Description

[Tran Quac]

Attachment: poc-broadcastchannel.cpp

Summary

RecvPBroadcastChannelConstructor (BackgroundParentImpl.cpp:789) dispatches an async principal check to the main thread, but the actor is already registered and operational before the check runs. The check itself only compares two attacker-controlled IPC values (PrincipalInfo-derived origin vs aOrigin), not whether the process is authorized for the principal. A compromised content process joins any origin's BroadcastChannel to inject or sniff cross-origin messages.

Root Cause

// BackgroundParentImpl.cpp:713-731 — Alloc: actor registered BEFORE check
PBroadcastChannelParent*
BackgroundParentImpl::AllocPBroadcastChannelParent(
    const PrincipalInfo& aPrincipalInfo, const nsACString& aOrigin,
    const nsAString& aChannel) {
  nsString originChannelKey;
  originChannelKey.Assign(aChannel);
  originChannelKey.AppendLiteral("|");
  originChannelKey.Append(NS_ConvertUTF8toUTF16(aOrigin));
  return new BroadcastChannelParent(originChannelKey);
  // Actor keyed on attacker-controlled aOrigin — already in the channel
}

// BackgroundParentImpl.cpp:789-812 — Recv: async check, returns IPC_OK() immediately
IPCResult BackgroundParentImpl::RecvPBroadcastChannelConstructor(...) {
  RefPtr<CheckPrincipalRunnable> runnable =
      new CheckPrincipalRunnable(parent.forget(), aPrincipalInfo, aOrigin);
  MOZ_ALWAYS_SUCCEEDS(NS_DispatchToMainThread(runnable));
  return IPC_OK();  // Actor already active — messages flow before check runs
}

Two flaws:

1. Race condition: AllocPBroadcastChannelParent registers the actor with originChannelKey derived from attacker-controlled aOrigin BEFORE any validation. Messages can be sent/received in the window between registration and the async check completing.

2. Insufficient check: CheckPrincipalRunnable (line 736) only verifies that PrincipalInfo.GetOrigin() == aOrigin — both values come from the content process. A compromised process sends consistent forged values and the check always passes. No ValidatePrincipal or process-authorization check exists.

What Gets Bypassed

BroadcastChannel origin isolation. The originChannelKey format is <channelName>|<origin>. By forging aOrigin, the attacker's actor joins the same channel key as the victim origin. This enables:

1. Message injection — attacker sends messages that arrive at all BroadcastChannel listeners for the victim origin
2. Message sniffing — attacker receives all messages broadcast by the victim origin on that channel

Impact

A compromised content process can:

• Read cross-origin BroadcastChannel messages — inter-tab communication for any origin is exposed
• Inject messages into another origin's BroadcastChannel — victim tabs receive attacker-controlled messages, potentially triggering state changes (logout, navigation, data corruption)
• Bypass site isolation — Fission process boundaries do not protect BroadcastChannel because the parent mediates message routing using only the attacker-controlled origin key

Affected

Firefox Release, Beta, Nightly, ESR (all current). Verified on mozilla-firefox/firefox main HEAD 2026-04-23.

Suggested Fix

See attached diff. Use ThreadsafeContentParentHandle for synchronous remote-type validation before actor registration, or gate the Alloc on a validated principal.

URL

https://searchfox.org/mozilla-central/source/ipc/glue/BackgroundParentImpl.cpp#789

Comment 1

[Tran Quac]

Attachment: suggested-fix.diff