From 2d33a536905fff702fabe663de89e097e57abc95 Mon Sep 17 00:00:00 2001
From: Stouelh <124311326+Stouelh@users.noreply.github.com>
Date: Thu, 23 Apr 2026 23:30:51 -0400
Subject: [PATCH] Foxhound: Add taint propagation for HashChangeEvent.oldURL
 and newURL

Signed-off-by: Stouelh <124311326+Stouelh@users.noreply.github.com>
---
 dom/base/nsGlobalWindowInner.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dom/base/nsGlobalWindowInner.cpp b/dom/base/nsGlobalWindowInner.cpp
index 5cd2bc6025b2..da765e0a1cb6 100644
--- a/dom/base/nsGlobalWindowInner.cpp
+++ b/dom/base/nsGlobalWindowInner.cpp
@@ -4511,6 +4511,10 @@ nsresult nsGlobalWindowInner::FireHashchange(const nsAString& aOldURL,
   init.mNewURL = aNewURL;
   init.mOldURL = aOldURL;
 
+  // Foxhound: Mark oldURL and newURL as taint sources for HashChangeEvent
+  MarkTaintSource(init.mOldURL, "HashChangeEvent.oldURL");
+  MarkTaintSource(init.mNewURL, "HashChangeEvent.newURL");
+
   RefPtr<HashChangeEvent> event =
       HashChangeEvent::Constructor(this, u"hashchange"_ns, init);