Closed Bug 1743722 Opened 4 years ago Closed 4 years ago

Console data persists outside of private windows

Categories

(DevTools :: Console, defect)

Product:
DevTools
Component:
Console
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED DUPLICATE of bug 1656312

People

(Reporter: hogansquarellc, Unassigned)

Details

(Keywords: reporter-external, Whiteboard: [reporter-external] [client-bounty-form] [verif?])

JavaScript console commands persist in memory outside of private windows.

Steps to replicate:

  • Open a private browser window and open the JavaScript console (Tools > Browser Tools > Web Developer Tools > Console)
  • Enter any command into the console associated with the private window. For testing, I used "console.log('testing...');"
  • Close the private window. You can quiet Firefox entirely as well.
  • Open Firefox in a regular window, then open the JavaScript console (Tools > Browser Tools > Web Developer Tools > Console)
  • Press the "up" arrow to iterate through the last console commands. The first one will be the console log you entered while in the private window.

This security bug is present in version 94.0.2 (64-bit).

Flags: sec-bounty?

It's not clear to me if the data this leaks is really meaningfully private. I'd be more worried if, for instance, debugger breakpoint locations (including URLs) were also persisted from private browsing. Either way, this feels like something for the devtools and private browsing folks to consider, so moving to devtools.

Type: task → defect
Component: Security → Console
Product: Firefox → DevTools

Looks like a duplicate of Bug 1656312, however the other one is not filed as a security bug.

Group: firefox-core-security
Status: UNCONFIRMED → RESOLVED
Closed: 4 years ago
Resolution: --- → DUPLICATE

Duplicates of this age do not qualify for a bug bounty, sorry.

Flags: sec-bounty? → sec-bounty-
You need to log in before you can comment on or make changes to this bug.