Executive brief
A vulnerability in Firefox's content process management could allow a compromised website to silently install permanent security exceptions for other websites. This would enable an attacker to intercept and modify encrypted (HTTPS) traffic for those sites without the user receiving any security warnings. The issue has been resolved in Firefox version 153.
Technical details
A missing authorization check in the 'ContentParent::RecvAddCertException' function within 'dom/ipc/ContentParent.cpp' allows a compromised content process to send an IPC message that forces the parent process to remember a TLS certificate override. The function fails to validate the hostname, port, or certificate parameters against the calling process's principal. An attacker who has already achieved code execution within a sandboxed content process can use this to inject persistent certificate exceptions into 'cert_override.txt', facilitating future man-in-the-middle (MITM) attacks against arbitrary domains. This vulnerability was fixed in Firefox 153.
Affected products
- Mozilla Firefox < 153
Timeline
- 2026-07-21: advisory: Mozilla Foundation Security Advisory 2026-68 published.
- 2026-07-21: patched: Fixed in Firefox 153.