1872601 - (CVE-2025-11717) The screen to edit a password is not hidden is recent app list and, at least, can be used for a screenshot

Status: VERIFIED FIXED

(Firefox for Android :: Logins, defect)

Description

[msd+bugzilla]

Attachment: 1.png

Steps to reproduce

1. Go to parameters > Id and Passwords > Recorded Id > give access with schema > Edit a field
2. Display the password by clicking on the eye icon
3. Go back to the home screen
4. In the recent screen app the URL, ID and password is displayed

Expected behavior

Like in private navigation mode, it is impossible to see a thumbnail of the screen in the Android recent app list and it is impossible to make a screenshot of this window.

Actual behavior

The password is displayed in the Android recent app list and I can make a screenshot of this window.

Device information

• Firefox version: 121.0.0
• Android device model: Samsung Galaxy S5
• Android OS version: 11

Comment 1

[Daniel Veditz [:dveditz]]

Note: the list of sites and passwords before you choose one to edit is blanked out in the app-card display, as is the page that displays a single username/password. It's specifically the "Edit a password" screen that is not protected.

Comment 2

[Daniel Veditz [:dveditz]]

I'm sorry, I reproduced it incorrectly. I see the same behavior for the individual password display screen. If you go into card view from either of those pages it is correctly blank, but if you go from that page to the phone's homescreen and -then- view the cards the data will be shown.

When you select the card you are correctly bumped back to the screen where you have to choose "saved logins" and present your biometrics or passwords.

Comment 3

[Chris Peterson [:cpeterson]]

Clearing Priority so we can reprioritize these bugs relative to our ux-fun-2024 bugs.

Comment 4

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons

Comment 5

[Ted Campbell [:tcampbell]]

Hi Jeff, can your squad take this as their current sec bug? We are trying to catch up on some that fell through the cracks

Comment 6

[Jeff Boek [:boek]]

Just added it to our backlog to pull in next sprint.

Comment 7

[Alexandra Virvara]

Attachment: (secure)

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/290fc9466ac0
https://hg.mozilla.org/mozilla-central/rev/84c402310a23
hide sensitive content of logins screens when in background r=android-reviewers,boek

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/84c402310a23

Comment 10

[Donal Meehan [:dmeehan]]

Alexandra, please add a beta uplift request when you have a moment.

Comment 11

[Alexandra Virvara]

Comment on attachment 9513588 [details]
(secure)

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: the fix helps hiding some sensitive information in logins screen (compose version)
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Go to Secret settings & enable compose logins
  Go to logins screen -> details screen -> edit screen or just enter add password screen.
  Send app in backround
  Observe the screen
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The fix adds a secure flag that doesn't allow taking screenshots of the current screen and doesn't allow seeing the screen content while the app is on background
• String changes made/needed:
• Is Android affected?: Yes

Comment 12

[Donal Meehan [:dmeehan]]

Comment on attachment 9513588 [details]
(secure)

Approved for 144.0b4

Comment 13

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/16d28d135ab5
https://hg.mozilla.org/releases/mozilla-beta/rev/b000deb6fe61

Comment 14

[Mira Lobontiu (Android QA)]

Attachment: 1872601.jpg

Verified as fixed on the latest Firefox for Android Nightly 145.0a1 from 9/24, and on Firefox for Android Beta 144.0b4 using a Samsung Galaxy S24 (Android 15).

Comment 15

[Daniel Veditz [:dveditz]]

Attachment: advisory.txt