1960560 - [Win] Passwords from Chrome are not imported with the migration wizard

Status: RESOLVED FIXED

(Firefox :: Migration, defect, P1)

Description

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Attachment: import.gif

Found in

• 138.0b7

Affected versions

• 139.0a1 (2025-04-14)
• 138.0b7
• 137.0.1
• 128.9.0esr
• 115.19.0esr

Tested platforms

• Affected platforms: Windows 10x64, Windows 11
• Unaffected platforms: Ubuntu 24, macOS 12

Steps to reproduce

1. Open about:preferences#general.
2. Import passwords from Google Chrome using the import wizard.

Expected result

• All passwords are imported.

Actual result

• No passwords are imported.

Regression range

• Most likely not a Firefox regression. I can reproduce the issue with Firefox 127.0a1 (2024-05-12), and I know that this worked in the past.

Additional notes

• Attached a screen recording.
• Edge cannot import passwords from the same Chrome profile.
• I can also reproduce this issue by creating a new offline Chrome profile and adding one password.
• There are some Chrome profiles that Firefox can import passwords from.
• Multiple errors can be seen in the console: Error: decryptData failed: 87 decryptData resource://gre/modules/OSCrypto_win.sys.mjs:205 _decryptUnversioned resource:///modules/ChromeWindowsLoginCrypto.sys.mjs:116 decryptData resource:///modules/ChromeWindowsLoginCrypto.sys.mjs:112 migrate resource:///modules/ChromeProfileMigrator.sys.mjs:467 ChromeProfileMigrator.sys.mjs:513:21 migrate resource:///modules/ChromeProfileMigrator.sys.mjs:513

Comment 1

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Hello! Ni? Mike to take a look at this.

L.e: It seems that payment methods are also affected (bug 1960569)

Comment 2

[Mike Conley (:mconley) (:⚙️)]

This could very well be a change in how Chrome is storing / encrypting their passwords.

From a quick scan through their code search tool, it appears that sometime in August of last year, a patch was landed that changed to an asynchronous OSCrypt implementation. This patch appears to have done the work of decrypting using the "old" mechanism, and then reencrypting with the new: https://chromium-review.googlesource.com/c/chromium/src/+/5782927

Unfortunately, the associated bug in the Chromium issue tracker is not accessible to me.

This is the migrator routine that they ran: https://chromium-review.googlesource.com/c/chromium/src/+/5782927/6/components/password_manager/core/browser/os_crypt_async_migrator.cc

Taking this until we can find a better owner.

Comment 3

[Mike Conley (:mconley) (:⚙️)]

What I've been able to determine is that I can reproduce this after updating an old Chrome profile with passwords to be up-to-date, and then accessing the passwords from Chrome settings. This showed me the OS authentication prompt, and I believe did the migration. At that point, importing passwords stopped working.

Comment 4

[Mike Conley (:mconley) (:⚙️)]

A current workaround is to export passwords from the Chrome-based browser to a CSV file, and then to import that CSV file either from the migration wizard or the Firefox password manager.

Comment 5

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Part 1: Generalize manual password import in the migration wizard. r?#migration-reviewers!

Comment 6

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Part 2: Add steps for importing passwords manually from Chrome on Windows. r?#migration-reviewers!

Comment 7

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Part 3: Stop offering to import payment methods from Chrome on Windows. r?#migration-reviewers!

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/79cda83f6023
Part 1: Generalize manual password import in the migration wizard. r=migration-reviewers,Gijs
https://hg.mozilla.org/integration/autoland/rev/d7d1ad154eb5
Part 2: Add steps for importing passwords manually from Chrome on Windows. r=migration-reviewers,fluent-reviewers,desktop-theme-reviewers,fxview-reviewers,omc-reviewers,Gijs,bolsson,pdahiya
https://hg.mozilla.org/integration/autoland/rev/1a60bf0fba00
Part 3: Stop offering to import payment methods from Chrome on Windows. r=migration-reviewers,Gijs

Comment 9

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/79cda83f6023
https://hg.mozilla.org/mozilla-central/rev/d7d1ad154eb5
https://hg.mozilla.org/mozilla-central/rev/1a60bf0fba00

Comment 10

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Follow-up: Remove accidental repeat of 4th step for Chrome password import in wizard. r?gijs!

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/abf908bc1607
Follow-up: Remove accidental repeat of 4th step for Chrome password import in wizard. r=Gijs,migration-reviewers

Comment 12

[agoloman]

https://hg.mozilla.org/mozilla-central/rev/abf908bc1607

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:mconley, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox139 to wontfix.

For more information, please visit BugBot documentation.

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)

Comment 15

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Part 2: Add steps for importing passwords manually from Chrome on Windows.

Original Revision: https://phabricator.services.mozilla.com/D246809

Comment 16

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Part 3: Stop offering to import payment methods from Chrome on Windows.

Original Revision: https://phabricator.services.mozilla.com/D248453

Comment 17

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Part 1: Generalize manual password import in the migration wizard.

Original Revision: https://phabricator.services.mozilla.com/D246808

Comment 18

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Part 2: Add steps for importing passwords manually from Chrome on Windows.

Original Revision: https://phabricator.services.mozilla.com/D246809

Comment 19

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Part 3: Stop offering to import payment methods from Chrome on Windows.

Original Revision: https://phabricator.services.mozilla.com/D248453

Comment 20

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1960560 - Follow-up: Remove accidental repeat of 4th step for Chrome password import in wizard.

Original Revision: https://phabricator.services.mozilla.com/D248699

Comment 21

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Users will see a repeated 4th step in the instructions for importing passwords from Chrome in Windows.
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: None.
• Explanation of risk level: Just removing a redundant step from a list in the markup.
• String changes made/needed: No.
• Is Android affected?: no

Comment 22

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Users on Windows using the migration wizard on Chrome will not have clear steps for importing passwords manually.
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Attempt to import passwords from a Chrome profile on Windows. Expected results are to see some steps that instruct the user on how to export their Chrome passwords to a CSV which the migration wizard will accept.
• Risk associated with taking this patch: Low.
• Explanation of risk level: These changes are restricted to the migration wizard, which has fairly robust automated testing.
• String changes made/needed: None.
• Is Android affected?: no

Comment 23

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Users on Windows using the migration wizard on Chrome will not have clear steps for importing passwords manually.
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Attempt to import passwords from a Chrome profile on Windows. Expected results are to see some steps that instruct the user on how to export their Chrome passwords to a CSV which the migration wizard will accept.
• Risk associated with taking this patch: Low.
• Explanation of risk level: These changes are restricted to the migration wizard, which has fairly robust automated testing.
• String changes made/needed: No - the strings introduced here are in "preview", meaning they won't go through localization for the Beta uplift - but this is okay, since this uplift includes changes which restrict showing the password import steps to users with en locales.
• Is Android affected?: no

Comment 24

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Users on Windows using the migration wizard on Chrome will be offered to import payment methods when payment methods can no longer be successfully imported.
• Code covered by automated testing: no
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Ensure that payment methods is not offered as something that can be imported from Chrome on Windows. It should be possible, however, to import payment methods from Chrome on Linux or macOS.
• Risk associated with taking this patch: Low.
• Explanation of risk level: It's a very small, isolated change.
• String changes made/needed: None.
• Is Android affected?: no

Comment 25

[Meridel [:meridel]]

Here is the completed copy.

The only open item is confirming with SuMo if an article needs to be updated.

Comment 26

[Ina Popescu, Desktop QA]

I've reproduced this issue in Nightly 139.0a1 (2025-04-14) on Windows 10 by following the steps from the bug description. The issue is no longer reproducible in the latest Nightly 140.0a1 (2025-05-12): saved passwords can be successfully imported by uploading a CSV file containing the passwords exported from Chrome( as per the instructions provided in the import wizard).
While testing, we also verified the saved password import from Microsoft Edge which worked as expected on both Windows 10 and Windows 11.

Scenarios covered during testing:

• using the Import Data wizard to import saved passwords from both Chrome and Edge when the browsers were closed and when they were open
• importing only saved passwords by selecting this specific option in the wizard
• importing saved passwords by selecting "Select All" in the wizard
• skipping last step and finalising the import process( no passwords being imported)
• Payment methods are not available to be imported from Chrome via the wizard in Nightly 140.0a1 on Windows
• testing on Nightly 140.0a1 DE build where the instructional strings are displayed in English
  These scenarios will also be tested in Firefox 139.0b8 when the build is available.

Please note that the option to import payment methods via the wizard is only available on macOS. Based on Comment 24, this feature should also be available on Linux too: "It should be possible, however, to import payment methods from Chrome on Linux or macOS." However, while testing this on Ubuntu 22.04, following data types are available for import from Chrome to Nightly 140.0a1(both installed as non-Snap): Bookmarks, Browsing history, Extensions and Form autofill data.
@Mike Conley, could you please confirm if this is expected on Linux not to have Payments methods and Saved Passwords available for import?

Regarding Comment 23, to make sure that we understand correctly what is the expected behavior in Beta: are the new instructional strings for the password import wizard visible only to users with EN locales in Beta, or are they also shown to non-EN users(but not localized)?

Comment 27

[Isabella Ssozi [:isabella]]

(In reply to Meridel [:meridel] from comment #25)

Here is the completed copy.

The only open item is confirming with SuMo if an article needs to be updated.

Hi Meridel, a SUMO article update has been requested. Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1965232

Comment 28

[Mike Conley (:mconley) (:⚙️)]

(In reply to Ina Popescu, Desktop QA from comment #26)

@Mike Conley, could you please confirm if this is expected on Linux not to have Payments methods and Saved Passwords available for import?

I apologize for the confusion - payment methods are not available on Linux. This is for the same reason why password import is also not available on Linux from Chrome-based browsers (bug 1513718).

Regarding Comment 23, to make sure that we understand correctly what is the expected behavior in Beta: are the new instructional strings for the password import wizard visible only to users with EN locales in Beta, or are they also shown to non-EN users(but not localized)?

For Nightly, we've removed the conditions that only show the strings to users in English locales and are letting the strings ride the trains. The patches here requested for uplift should only be visible in EN locales. Non-en locales will still show the ability to import passwords from Chrome, but will report having imported 0 passwords.

Comment 29

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/c764db9c23f9
https://hg.mozilla.org/releases/mozilla-beta/rev/50899c08eb34
https://hg.mozilla.org/releases/mozilla-beta/rev/6c48985e7b17
https://hg.mozilla.org/releases/mozilla-beta/rev/e5d19272a701

Comment 30

[Bianca Hidecuti, Desktop Test Engineering [:bhidecuti]]

We've tested all scenarios mentioned in Comment 26 using Firefox 139.0b8 on both Windows 10 and Windows 11, and the behavior described in that comment still applies.
Additionally, we verified that non-en locales still show the ability to import passwords from Chrome (in Beta), and the "Data Imported Successfully" message reports that 0 passwords were imported.
We also noticed that the Payment methods option is no longer displayed when importing data from Microsoft Edge browser - logged bug 1966640 for this.
Marking this verified as fixed.