tor-browser

commit 233f1f890ae795c72f979ae2759d8558a11a1354
parent 16d14c6570b6456b21e8116ccdc2fa7c818e9519
Author: Andreas Farre <farre@mozilla.com>
Date:   Fri, 24 Oct 2025 13:32:22 +0000

Bug 1996216 - Disable support for Navigation API in documents embedded by object/embed. r=jjaschke

Differential Revision: https://phabricator.services.mozilla.com/D269945

Diffstat:
M
dom/navigation/Navigation.cpp
 | 
6
+++++-

1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/dom/navigation/Navigation.cpp b/dom/navigation/Navigation.cpp
@@ -301,7 +301,11 @@ bool Navigation::HasEntriesAndEventsDisabled() const {
          // channels from having events or entries. See bug 1996218 and bug
          // 1996221
          SupportsInterface<nsIMultiPartChannel>(doc->GetChannel()) ||
-         SupportsInterface<nsIScriptChannel>(doc->GetChannel());
+         SupportsInterface<nsIScriptChannel>(doc->GetChannel()) ||
+         // We also disallow documents embedded using <object>/<embed>. See bug
+         // 1996215.
+         !doc->GetBrowsingContext() ||
+         doc->GetBrowsingContext()->IsEmbedderTypeObjectOrEmbed();
 }
 
 // https://html.spec.whatwg.org/#initialize-the-navigation-api-entries-for-a-new-document