1705068 - (CVE-2021-29963) Private Browsing not respected for search suggestions

Status: VERIFIED FIXED

(Fenix :: General, defect)

Description

[Wladimir Palant]

The problematic code can be seen here:

https://github.com/mozilla-mobile/android-components/blob/78979a815d9ba671e6cc8009ef50b80a26ab7896/components/feature/awesomebar/src/main/java/mozilla/components/feature/awesomebar/provider/SearchSuggestionProvider.kt#L247-L251

The request retrieving search suggestions does not respect Private Browsing mode. While Fenix doesn’t have search suggestions enabled by default in Private Browsing and warns about the impact (everything typed into address bar sent to search provider), this is still unnecessary. Once a search is accepted, this allows search providers (by default Google) to match the regular search session to the private one.

The issue can be confirmed by debugging the network traffic of the main process: search suggestions always send the cookies from the regular session, regardless of whether the user is currently in a private tab.

Comment 1

[Sebastian Kaspari (:sebastian; :pocmo)]

I'll take a stab at this.

Comment 2

[Sebastian Kaspari (:sebastian; :pocmo)]

A patch for this landed in A-C and Fenix (90.0):

• A-C: https://github.com/mozilla-mobile/android-components/commit/962e79303bd96b85aed2cf7ca46f4a4a10aa9434
• Fenix: https://github.com/mozilla-mobile/fenix/commit/6a1b5875b0964838037472843d9b1da15bc23b29

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Is this something we should consider backporting to AC75/Fenix89?

Comment 4

[Sebastian Kaspari (:sebastian; :pocmo)]

Uplifting to AC75: https://github.com/mozilla-mobile/android-components/pull/10274

Comment 5

[Sebastian Kaspari (:sebastian; :pocmo)]

AC 75.0.16 is getting built.

Comment 6

[Sebastian Kaspari (:sebastian; :pocmo)]

Fenix PR with AC version bump and patch uplift:
https://github.com/mozilla-mobile/fenix/pull/19537

Comment 7

[Ryan VanderMeulen [:RyanVM]]

This merged for Fenix 89.0.0-beta.8 also.
https://github.com/mozilla-mobile/fenix/commit/2c2cec6ea17ab3b8816e2031a9f1394c79280478

Comment 8

[Andrei Bodea[:andrei]]

Verified as fixed on Fenix 89.0.0-beta8 and 9 with Google Pixel 4 XL (Android 11).
Note that the Allow search suggestions in PB prompt was displayed when first time typing in the URL bar.

Comment 9

[Frederik Braun [:freddy]]

Attachment: advisory.txt