1782943 - The google login page saves the wrong password if the user introduces a wrong than right password

Status: NEW

(Toolkit :: Password Manager, defect, P2)

Description

[Daniel Bodea [:danibodea]]

Attachment: demo.mp4

Note

• When the user attempts to log into a google account, inputs the wrong password the first time, and correct one the second time, the login save door hanger with the wrong password remains displayed. If the user saves it, he is saving incorrect login credentials.

** Found in**

• Beta v104.0b4

Affected versions

• Beta v104.0b4
• Release v103.0.1

Affected platforms

• all

Steps to reproduce

1. load www.google.com
2. Click "Sign in"
3. input the username
4. input an incorrect password
5. input the correct password
   Notice that the door hanger with the wrong password is still displayed.
6. Click "Save"
7. Check the credentials saved in about:logins

Expected result

• The correct password is saved.

Actual result

• The wrong password is saved.

Regression range

• not a recent regression since it also occurs in release 103

Additional notes

• It appears that this issue might not occur if the google account does not have basic/default safety activated, because in that case, the user will be redirected to the homepage and the "wrong" login door hanger will be dismissed.

Comment 1

[Daniel Bodea [:danibodea]]

This issue occurs when having activated the 2-step-verification as well.

Unfortunately, there isn't enough "data to bisect". the range I could determine is:
Narrowed nightly regression window from [2021-06-12, 2021-06-14] (2 days) to [2021-06-12, 2021-06-13] (1 days) (~0 steps left)

Tested mozilla-central build: 2021-06-12 (verdict: g)
Tested mozilla-central build: 2021-06-13 (verdict: b)

The issue started reproducing when the door hanger to save credentials started appearing for unsuccessful login attempts. Tested on Windows 10.