1926488 - mail.google.com - Unable to play videos sent via chat with Standard ETP

Status: NEW

(Web Compatibility :: Privacy: Site Reports, defect, P2)

Description

[Calin Tanase]

Attachment: Tested with this video sample.mp4

Environment:
Operating system: Windows 10
Firefox version: 131/133

Preconditions:
• ETP set to STANDARD
• Must be logged in
• Download the sample video provided in attachments

Steps to reproduce:

1. Go to https://mail.google.com
2. Open a chat with anybody.
3. Upload the provided video in the chat.
4. Wait for the upload to be completed.
5. Click on the video and try to play it.

Expected Behavior:
The video can be played.

Actual Behavior:
The video does not play.

Notes:

1. Screen rec attached
2. Reproducible with Standard and Strict ETP
3. Does not reproduce with ETP turned OFF
4. Same behavior in Private mode
5. Not reproducible on Chrome

Comment 1

[Calin Tanase]

Attachment: ETP Strict vs Standard vs OFF.mp4

Comment 2

[Dan Mehic]

Could you take a closer look please?

Comment 3

[Leander Schwarz]

Hi, this is caused by TCP / a third-paryt cookie missing. This is also broken in Chrome with third-party cookie blocking enabled.

Comment 4

[Tim Huang[:timhuang]]

This is actually a TCP issue but not a 3PCD issue. The video starts to place if I disabled TCP regardless of 3PCD.

Comment 5

[Tim Huang[:timhuang]]

Sorry, it's actually also a 3PCD issue. We also disable 3PCD if TCP is disabled, so I misunderstood the issue.

Comment 6

[Emma Zühlcke [:emz]]

Seeing if we can shim this. Surprisingly this works in Safari.

Comment 7

[Emma Zühlcke [:emz]]

Ok so this is the embed hierarchy:

https://mail.google.com -> https://chat.google.com (iframe) -> https://youtube.googleapis.com (iframe) -> https://chat.google.com (video element src)

We can temporarily allowlist this pair: https://mail.google.com,https://chat.google.com. I have not found an easy way to shim this yet, but I'll keep looking.

Comment 8

[Emma Zühlcke [:emz]]

This seems tricky to shim, because the inner most origin is the video src itself, so it can't call the storage access API. The upcoming Storage Access Headers feature may help here. I'll reach out to Google to see if they can fix this issue.

Comment 9

[Emma Zühlcke [:emz]]

Lowering severity and unassigning now that an intervention is deployed. In the meantime I've reached out to Google and I'm waiting to hear back.