Summary

Firefox isolates web content in sandboxed child processes while sensitive data such as saved addresses and credit cards lives in the trusted parent process. The two sides communicate through message actors, and the parent must never trust a message from content without a check.

Four FormAutofill message handlers meant only for automated testing were shipped in production without a guard. The actor was registered with allFrames and no origin restriction, so any content process could call them directly to read, inject, or delete stored autofill data with no authorization.

Root cause

The handlers GetRecords, SaveAddress, SaveCreditCard and RemoveCreditCards carried a comment marking them test-only, but the Cu.isInAutomation guard that should gate them was missing. A regression from bug 1887007 left them reachable from any renderer.

Proof of concept

• From a compromised content process, obtain the FormAutofill actor for the current window.
• Call GetRecords to read every saved address and credit card in the clear.
• Call SaveAddress or SaveCreditCard to inject attacker-controlled autofill data.
• Call RemoveCreditCards to delete all stored payment methods.

Impact

Full exfiltration of saved credit cards and addresses, silent injection of attacker data that autofills on future forms, and destructive deletion of all stored payment methods. Each is reachable with a single message once a renderer is compromised.

Fix

// gate every test-only handler behind the automation check
if (!Cu.isInAutomation) {
  throw new Error("Test-only message received outside automation");
}