Mechanism (verifiable from source)

The FormAutofill JSWindowActor pair (FormAutofillChild in content and FormAutofillParent in the parent process) exchanges messages. In current mozilla-central FormAutofillParent.receiveMessage gates anything outside the allow set behind the automation check:

The source comment states that the Save and Remove handlers are invoked only by tests:

• FormAutofill:SaveAddress
• FormAutofill:SaveCreditCard
• FormAutofill:RemoveAddresses
• FormAutofill:RemoveCreditCards

On the affected builds those test-only handlers were reachable without the Cu.isInAutomation gate so a content context could reach FormAutofill paths that were never meant to face web content. Mozilla rated the resulting exposure as information disclosure of stored autofill data.

Note on reach: getActor lives on windowGlobalChild, a chrome only property. Ordinary page script never sees it, so the threat model is a content process an attacker already influences (a renderer compromise or a content side code path) issuing the actor message, not a plain web page. The harness attempts the content path and reports honestly whether the parent answered or the boundary held.

The exact disclosure primitive lives in bug 2022419 which is security restricted. This harness demonstrates the reachability of a test-only handler that a fixed build blocks. Pass the precise call your own report used with --message.

Threat model

A content process that an attacker already influences (a renderer compromise or a content side code path) sends a FormAutofill actor message that should only ever come from the test harness. On a vulnerable build the parent answers. On a fixed build the automation gate drops it.

Prerequisites

1. A vulnerable build. Any Firefox before 150 or ESR before 140.10. The write up screenshots use Firefox 140.9.0esr. Download the matching platform build from the official Mozilla archive at https://ftp.mozilla.org/pub/firefox/releases/140.9.0esr/.
2. Python with the Marionette client:
   root@kitploit:~

   pip install marionette-driver
   

3. A throwaway profile seeded with synthetic autofill data. Never use real personal or payment data.

Seed a synthetic profile

Start the vulnerable build with a fresh profile and Marionette enabled:

Then in about:preferences#privacy add one synthetic saved address and one synthetic card, for example name POC TESTER, card number 4111 1111 1111 1111. This is test data only.

Run

Browser-toolbox fallback

getActor is chrome only, so from the content sandbox the plain harness reports the actor as unreachable (see poc-run.png). To drive the message from a context that actually holds the actor, on a vulnerable build enable the Browser Toolbox (devtools.chrome.enabled and devtools.debugger.remote-enabled), open it with Ctrl+Alt+Shift+I, and from the content-process console fetch the actor off windowGlobalChild and call sendQuery with the same synthetic payload. This mirrors the compromised-content-process threat model without any real data.

Expected result

• Vulnerable build: the harness reaches the FormAutofill actor from content and the test-only handler executes. The script prints the returned or mutated Form Autofill state, showing the boundary that should not be crossable.
• Fixed build (150 or ESR 140.10 and later): the same call returns undefined because Cu.isInAutomation is false. The script reports that the gate is enforced.

Verification status

This harness was authored from the public record and the current mozilla-central source. It was executed here against the local Firefox 140.11.0esr build, which is already patched for CVE-2026-6765. The captured run is in poc-run.png: from the content context the FormAutofill actor is not reachable (windowGlobalChild.getActor is not exposed to content), so the parent boundary holds. That is the correct, honest outcome on a fixed build.

To observe the boundary being crossed you need a vulnerable build (Firefox before 150 or ESR before 140.10, for example 140.9.0esr) plus a throwaway profile seeded with synthetic autofill data, and you drive the actor message from a content-process context per the browser-toolbox fallback above. Adjust --message to the exact primitive from your original report.

Scope and ethics

This targets a locally downloaded build with synthetic data for a writeup of the author's own reported and already patched CVE. It does not attack any live or third party service.