Closed Bug 1639355 Opened 11 months ago Closed 11 months ago

Perpetual PDF Spam


(Firefox :: PDF Viewer, defect)

76 Branch





(Reporter: suryanshmansha, Unassigned)


(Keywords: csectype-dos)

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:76.0) Gecko/20100101 Firefox/76.0

Steps to reproduce:

  1. Start Firefox by clicking on the desktop icon
  2. Press Cmd+N (or Ctrl+N for Windows users) to open a new browser window
  3. Search for a PDF file via the search bar in Firefox
  4. Open the PDF file by clicking on the link

Actual results:

Upon opening the PDF file, Firefox begins to spam new tabs continuously and the user is unable to exit the browser without force quitting. In addition, the tabs produced have no content at all.

At times, after the user force quits, the background image of the desktop completely disappears along with the time, WIFI icons, etc. located at the top right of the screen. As the user restarts their Firefox browser, they are greeted with a message which says, "Sorry. We're having trouble getting your pages back." and the user has to either restore or start a new session. This shows the main issue regarding the perpetual spam of new tabs upon opening a PDF file in Firefox, but it seems as if the black background and the computer freezing issue only occurs at times and at other times, doesn't. The issue demonstrated also affected the Finder and any other applications of the Macbook since they all froze and I wasn't able to move any applications at all.

Device used: 2012 Macbook Air

Expected results:

Expected Result: Upon opening the PDF file, the file should have been successfully opened without spamming multiple tabs and the user should still have the ability to interact with the computer.

In mail to the security@ alias the reporter included a movie. Copying the steps my google search returned the same simple PDF file shows in the movie -- it has nothing to do with the content of the file. I could not reproduce the behavior in a fresh profile (or even in my well-used one, for that matter). This appears to be the Mac equivalent of bug 1517934 and bug 1627436, that is, the underlying problem is bug 167320 where we don't protect users from creating an infinite loop between Firefox and the OS on which is the default handler app.

The self-fix for your profile is to open Firefox preferences and scroll down the "General" pane to the Applications section. Set "Portable Document Format (PDF)" to "Preview in Firefox". In Firefox 76 which you appear to be using if it says "Open in.." then it's getting sent to the OS and creating this loop.

In the next version of Firefox (you can try this in Beta) we've changed the wording so that "Open in Firefox" (the first option) is the one you want to use, and the problematic setting has been changed from trying to name the OS default app to simply "Use macOS default application" (or Windows, etc, as appropriate). (see bug 1581383 for details)

Closed: 11 months ago
Flags: sec-bounty?
Keywords: csectype-dos
Resolution: --- → DUPLICATE
Duplicate of bug: 167320
Flags: sec-bounty? → sec-bounty-
You need to log in before you can comment on or make changes to this bug.