1436432 - Currently viewed webpage (even in Private browsing!) is shared to other devices via IOS Handoff

Status: VERIFIED FIXED

(Firefox for iOS :: Browser, defect, P1)

Description

[Brian]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36

Steps to reproduce:

Opened any webpage (eg. www.cheese.com) in a normal or PRIVATE tab in Firefox my Apple IPhone (IOS11.2.4). Then, on my Apple iPad (IOS11.2.4) the handoff function on the dock will open that same webpage (eg. www.cheese.com) in a Safari window.


Actual results:

As described above. My iPad is a shared device with other family members, which could potentially inadvertently see my current PRIVATE browsing via the handoff feature.


Expected results:

Firefox private tab browsing should absolutely NOT be shared to other devices. I don't want anyone else who uses my shared devices to know how much I love cheese.com

Comment 1

[Brian]

Attachment: Screencaps of iPhone Firefox PRIVATE tab sending webpage to Safari on iPad via handoff

Comment 2

[Brian]

Correction for accuracy: these are the actual iOS versions running on the affected devices in the original report:
iPhone: 11.2.2 (15C202)
iPad: 11.2.1 (15C153)

I'm not sure what iOS versions are affected by this issue.

Comment 3

[Simon Basca [:SimonB]]

Thanks for the report Brian. Confirming that this is reproducible on 10.6 and 11.0(8861). We should not share Private Tabs via Handoff.

Comment 4

[Justin D'Arcangelo [:justindarc]]

Attachment: GitHub Pull Request

Comment 5

[James Hugman [:jhugman] [@jhugman]]

Comment on attachment 8952816 [details] [review]
GitHub Pull Request

Feedback in PR. 

R? again when ready.

Comment 6

[Justin D'Arcangelo [:justindarc]]

Comment on attachment 8952816 [details] [review]
GitHub Pull Request

Upgrades to `siteURL` from metadata parser now (when available).

Comment 7

[Justin D'Arcangelo [:justindarc]]

Landed on master:

https://github.com/mozilla-mobile/firefox-ios/commit/0dddd260d97a005df4749a86993390c66c2997c3

Landed on v11.x:

https://github.com/mozilla-mobile/firefox-ios/commit/3029f27b4cf8bd012a8212a58de50f7125718844

Comment 8

[Simon Basca [:SimonB]]

Verifying as fix on master 6672352af5. Tabs from Private Browsing are no longer shared via Handoff.

Comment 9

[Simon Basca [:SimonB]]

Verifying as fix on 11.0(9266).

Comment 10

[Daniel Veditz [:dveditz]]

This is a valid privacy concern, but is not a potential exploit of the type that our Bug Bounty program covers.