1540565 - TabTracker leaks information about existence of private tabs/windows despite lack of private browsing permission

Status: NEW

(WebExtensions :: General, defect, P3)

Description

[Rob Wu [:robwu]]

There are several APIs that use the TabTracker to map a tabId to a native tab. Since the TabTracker is a singleton and unaware of the extension that is associated with the call, it's possible for an extension to learn whether private browsing mode is being used.

STR:

1. Visit about:debugging and use "Debug" on any extension with a page action.
   Make sure that the extension does not have access to private browsing mode (feature from bug ).
2. Run the following snippet to learn the current tab ID.

browser.tabs.create({}, tab => console.log(window.lastTabId = tab.id));

3. Open a private browsing mode. The ID of that the tab in the new window is the result of step 2, plus one.
4. Run the following snippet:

// lastTabId from step 2.
browser.tabs.get(lastTabId + 1).then(console.log, console.error);
browser.pageAction.hide(lastTabId + 1).then(() => console.log("tabId is valid"), console.error);

Expected:

• Error: "Invalid tab ID: 9"
• Error: "Invalid tab ID: 9"

Actual:

• Error: "Invalid tab ID: 9"
• tabId is valid

This difference in output can be used to detect whether there is a private browsing window.

Comment 1

[Shane Caraveo (:mixedpuppy)]

I reviewed all the use of tabTracker.getTab, outside of the example for determining that there is a private window, I don't see any way for data to leak. If data were to leak from the private window, this would be a high concern.

Comment 2

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1540565 make the telemetry permission privileged

add telemetry to the privileged permissions list

Comment 3

[Phabricator Automation]

Comment on attachment 9066285 [details]
Bug 1540565 make the telemetry permission privileged

Revision D31935 was moved to bug 1552998. Setting attachment 9066285 [details] to obsolete.

Comment 4

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1540565 support context checking in tabTracker

Comment 5

[Luca Greco [:rpl] [:luca] [:lgreco]]

this issue seems to already have a patch in work, is something you may pick it up again?

Comment 6

[Shane Caraveo (:mixedpuppy)]

probably at some point, the patch bitrotted and would have to be reworked. I don't see this as a big problem, but the patch does offer a bit of cleanup.

Comment 7

[Daniel Veditz [:dveditz]]

sec-other per bug 1699458 comment 2 and 4