From edfc80c7c473b9a09eba9e98e59c4d7d167bbb9e Mon Sep 17 00:00:00 2001
From: Joshua Rogers <MegaManSec@users.noreply.github.com>
Date: Wed, 20 May 2026 01:03:31 +0200
Subject: [PATCH] urlapi: compare zone-id in Curl_url_same_origin()

Closes #21686
---
 lib/urlapi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/urlapi.c b/lib/urlapi.c
index dfb106dd2f..21f4bbfab1 100644
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -2024,6 +2024,9 @@ bool Curl_url_same_origin(CURLU *base, CURLU *href)
   if(href->host) {
     if(!curl_strequal(base->host, href->host))
       return FALSE;
+    if(!curl_strequal(base->zoneid ? base->zoneid : "",
+                      href->zoneid ? href->zoneid : ""))
+      return FALSE;
     if(!curl_strequal(base->port, href->port)) {
       /* This may still match if only one has an explicit port
        * and it is the default for the scheme. */