1935842 - Wrong AAGUID on macos with cross-platform attachment when using Android phone (Google password manager) to create a passkey

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P2)

Description

[Nripendra]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0

Steps to reproduce:

Register a passkey on macos with cross-platform attachment, and use android phone (which uses Google password manager) to create a passkey.

Actual results:

When parsing the PublicKeyCredential generated on the server, the AAGUID is set to all zeros.

Expected results:

Set the correct AAGUID of the authenticator. All other major browsers Safari, Chrome, Edge is resolving to correct AAGUID that belongs to the Google password manager.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Cocoa' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:spohl, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Kemeros]

Same issue with Firefox on Android with Bitwarden. Tried from Firefox 139 all the way to Firefox 147 beta. Same issue.

I observed this behavior on both webauthn.io and amazon.ca.

Comment 4

[Kemeros]

Attachment: Screenshot_20251212-085417.png

Comment 5

[Kemeros]

I added a screenshot. As you can see, webauthn.io thinks i'm using iCloud Keychain because of the invalid AAGUID. Same thing on amazon.ca

Comment 6

[Kemeros]

I saw an old reddit post that said to put the attestation in direct mode in webauthn.io. They said it worked for them on Google Chrome.

This bug seems to be different as using direct mode in the webauthn.io advanced registration settings does not fix this.

Comment 7

[Kemeros]

@Stephen: Would it be possible to reprioritize this bug?

This bug makes passkeys implementation look flimzy and unreliable. This was enough to stop me from using passkeys for the past year. I understand it might seem like a cosmetic problem but i think that this bug could hinder trust and delay passwordless adoption for users like me.

Comment 8

[Kemeros]

This issue is still present on Android for the latest Firefox (149/150.0b2) and Bitwarden(2026.3.0).

Are we missing information/something to get this bug confirmed and assigned?

Comment 11

[John Schanck [:jschanck]]

Attachment: Bug 1935842 - allow non-zero AAGUID in anonymized attestation statements. r=keeler

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/d3a8098982f7
https://hg.mozilla.org/integration/autoland/rev/92905fd11e4a
allow non-zero AAGUID in anonymized attestation statements. r=keeler

Comment 13

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/92905fd11e4a