From 41f3240a36c2bc6dc590bb4285d9ef932fff8a1f Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Thu, 27 Aug 2026 20:10:09 -0700
Subject: [PATCH] fix(window): reject non-document navigation schemes

---
 src/main/window/privileged-window-navigation.test.ts | 5 ++++-
 src/main/window/renderer-document-navigation.ts      | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/main/window/privileged-window-navigation.test.ts b/src/main/window/privileged-window-navigation.test.ts
index d9cac45cf95..579d830f244 100644
--- a/src/main/window/privileged-window-navigation.test.ts
+++ b/src/main/window/privileged-window-navigation.test.ts
@@ -55,13 +55,16 @@ describe('privileged window navigation policy', () => {
     expect(openExternal).toHaveBeenCalledWith('https://example.com/')
   })
 
-  it('lets the dev renderer origin navigate but not a foreign origin', () => {
+  it('lets the dev renderer origin navigate but blocks foreign documents', () => {
     const fixture = createFixture('http://localhost:5173/')
 
     expect(
       fixture.willNavigate('http://localhost:5173/index.html').preventDefault
     ).not.toHaveBeenCalled()
     expect(fixture.willNavigate('https://example.com/').preventDefault).toHaveBeenCalled()
+    expect(
+      fixture.willNavigate('blob:http://localhost:5173/attacker-document').preventDefault
+    ).toHaveBeenCalled()
   })
 
   // Why: the packaged file: path is the whole privilege boundary, so a foreign host or a
diff --git a/src/main/window/renderer-document-navigation.ts b/src/main/window/renderer-document-navigation.ts
index 06e129f8099..50fb128b633 100644
--- a/src/main/window/renderer-document-navigation.ts
+++ b/src/main/window/renderer-document-navigation.ts
@@ -19,6 +19,7 @@ export function isRendererDocumentNavigation(currentUrl: string, nextUrl: string
     }
     return (
       (current.protocol === 'http:' || current.protocol === 'https:') &&
+      (next.protocol === 'http:' || next.protocol === 'https:') &&
       next.origin === current.origin
     )
   } catch {