2045496 - (CVE-2026-12316) Sanitizer API allows one-click XSS with SVG animation due to incomplete namespace check when clearing xlink:href

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Frederik Braun [:freddy]]

Attachment: sanitizer-bypass-xlink.html

The bug (one sentence): safe-mode setHTML guards SMIL href-animation by literal string comparison of attributeName against "href"/"xlink:href" (Sanitizer.cpp:1644 - and the spec specifies exactly this), but SMIL consumes attributeName as a QName resolved against live-tree namespace bindings, so attributeName="k:href" slips through and animates xlink:href to a javascript: URL.

Preconditions:

1. custom config allowing svg+a+set/animate+attributeName/to/begin/dur+xlink:href, each looks innocuous, none are event handlers;
2. any ancestor of the insertion point binding a non-xlink prefix to the XLink URI (XHTML, XSLT output, editor-generated SVG with ns1:-style prefixes, DOM-built declarations);
3. one user click on attacker-controlled link text. Not reachable with the "default" preset (no animation elements).

Fix (both Gecko and spec): remove attributeName when its value is "href" or ends with ":href" — complete, because SMIL needs the local part to be exactly href to bind the animatable slots; no prefix spelling can evade a suffix rule.

Comment 1

[Frederik Braun [:freddy]]

Attachment: (secure)

Comment 2

[Frederik Braun [:freddy]]

Reminder that the test case needs to be integrated into wpt when this is fixed in affected engines

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/1abacf3593ed
https://hg.mozilla.org/integration/autoland/rev/848035deee86
improve namespace handling in sanitizer api r=tschuster

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/848035deee86

Please add a Beta uplift request on this.

Comment 5

[Frederik Braun [:freddy]]

Uplift requested via Lando.

Comment 6

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: Fixes an issue in a web security API. Web page that rely on the Sanitizer API (in a really, really unlikely configuration) might not get the XSS protection they want.
• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: We reproduced & tested manually. There's a test case in the repo that we did not want to land directly, as we are coordinating the fix with the specification and other implementations (even though they are all likely not affected)
• Risk associated with taking this patch: low
• Explanation of risk level: One line code change, just changing an if-clause comparison.
• String changes made/needed?: N/A
• Is Android affected?: yes

Comment 7

[Frederik Braun [:freddy]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D305042

Comment 8

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/db0f71d21b21
https://hg.mozilla.org/releases/mozilla-beta/rev/238e038e9947