1967702 - Private tabs are accessible without authentication when opening a link in a private tab from a non-private page

Status: VERIFIED FIXED

(Firefox for Android :: Privacy, defect)

Description

[Vasilica Tamas (Android QA) [:vtamas]]

Attachment: OpenLinkInPrivateTab.mp4

Preconditions

Lock tabs feature is enabled.

Steps to reproduce

1. Open at least one private tab.
2. Switch to non-private mode.
3. Minimize and restore the app.
4. Navigate to a webpage in normal browsing, long tap on a link and select "Open link in new tab"
5. Tap on "Switch" button from snackbar.
6. Swipe the address bar in order to visit the other opened private tabs.

Expected behavior

Biometric authentication is prompted either before opening a link in private mode or when swiping to access already opened private tabs.

Actual behavior

Biometric authentication is not required, allowing private tabs to be accessed by swiping the address bar.

Device information

• Firefox version: Firefox for Android Nightly 140 (2025-05-20)
• Android device model: Samsung S24 Ultra (Android 14), Google Pixel 8 (Android 15)

Additional information

This issue is also reproducible when opening a top site from homescreen by long tapping and selecting "Open in private tab".

Comment 1

[Mike a [:mavduevskiy]]

Attachment: Bug 1967702 - Update appstate from BaseBrowserFragment

There are multiple cases when switching between private tabs results in incorrect appstate since mainly update it from the homepage (and tabstrip) but BrowserFragment is relying on BrowserModeManager and appstate isn't being updated.

I believe that's a safe change. Reads happen on HomeFragment after it updated the appstate.mode during onCreateView so we don't interfier with existing flow. This targets specifically tab page, that doesn't have logic related to appstate.mode.

Also, there are cases of updating state from the tabstrip and tabstraycontroller, so I don't expect new side-effects.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6355f5807d0a
Update appstate from BaseBrowserFragment r=android-reviewers,twhite,gmalekpour

Comment 3

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/6355f5807d0a

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:mavduevskiy, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox140 to wontfix.

For more information, please visit BugBot documentation.

Comment 5

[:Gela]

Attachment: Bug 1967702 - Update appstate from BaseBrowserFragment

There are multiple cases when switching between private tabs results in incorrect appstate since mainly update it from the homepage (and tabstrip) but BrowserFragment is relying on BrowserModeManager and appstate isn't being updated.

I believe that's a safe change. Reads happen on HomeFragment after it updated the appstate.mode during onCreateView so we don't interfier with existing flow. This targets specifically tab page, that doesn't have logic related to appstate.mode.

Also, there are cases of updating state from the tabstrip and tabstraycontroller, so I don't expect new side-effects.

Original Revision: https://phabricator.services.mozilla.com/D251424

Comment 6

[:Gela]

Requested uplift here https://phabricator.services.mozilla.com/D251724

Comment 7

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Without this patch, private tabs are accessible without authentication when opening a link in a private tab from a non-private page
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Steps outlined in ticket 1967702
• Risk associated with taking this patch: medium to low
• Explanation of risk level: This impacts homepage and any othersurfaces using base browser fragment. However, without this change an attacker can gain access to a user's presumably locked private browsing so it is needed.
• String changes made/needed: n/a
• Is Android affected?: yes

Comment 8

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/28edee773298

Comment 9

[Vasilica Tamas (Android QA) [:vtamas]]

Attachment: 20250530_143102.mp4

This issue is verified as fixed on Firefox for Android Nightly 141 (2025-05-29) using Samsung S24 Ultra (Android 14), Google Pixel 8 (Android 15) and Xiaomi 12T (Android 12). Confirming that the Biometric authentication is prompted when switching to Private Mode.

Comment 10

[Vasilica Tamas (Android QA) [:vtamas]]

This issue is verified as fixed on Firefox 140 beta 5 on Samsung Galaxy S24 Ultra (Android 15) and Xiaomi 12T (Android 12). Confirming that the Biometric authentication is prompted when taping on "Switch" button from the snackbar.