1968434 - New tabs opened from a private tab by the "AI Toolbox" add-on are not private

Status: RESOLVED DUPLICATE of bug 1870978

(Firefox for Android :: WebExtensions, defect)

Description

[Miles Turner]

User Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7.2 Mobile/15E148 Safari/604.1

Steps to reproduce:

1.Install the "Ai Toolbox" extension in Firefox for Android.
2.Enable the "Open in New Tab" option in the extension settings.
3.Open a private tab.
4.Use the "Ai Toolbox" extension to open a page in the private tab.
5.Check the browsing history.
https://www.whatismybrowser.com/w/ZDB5KWX
My device is actually running Android 9, but when I checked the User-Agent string, it reported Android 10. I am not sure why there is a discrepancy, but I wanted to mention it in case it is relevant.

Actual results:

Pages opened in private tabs should not be saved in browsing history.

Expected results:

Pages opened by the "Ai Toolbox" extension in private tabs are saved in browsing history.

Comment 1

[Miles Turner]

Click the homepage button (an icon resembling a bug) next to an installed script in the Tampermonkey extension management panel.

After opening the script's homepage via this button, the page visited in the private tab is still saved in the browser history.

Comment 2

[Daniel Veditz [:dveditz]]

Is the "AI Toolbox" addon this one? https://addons.mozilla.org/en-US/firefox/addon/ai-toolbox/

If not, where did you get yours?

4.Use the "Ai Toolbox" extension to open a page in the private tab.

So far it sounds more likely that the "AI Toolbox" extension itself is not asking for the new window to be private, rather than the catastrophic global privacy failure that your summary claims (and that we test regularly). It's also possible that the Android version of that web extension API is broken wrt the private window handling -- we'd have to check the specific addon's code to see once you confirm which one it is.

It's also possible that even if it's the first possibility (bug in the addon) that maybe there's a second bug in the Fenix UI that gives a tab the "private browser" treatment without checking whether it's actually private or not, simply based on where it was opened. There are any number of less likely reasons.

If it's the one from AMO then the new tab is opened with the following code from "main.js":

    if (toggleSwitch.classList.contains("active")) {
      browser.tabs.create({ url: website }).catch(console.error);
    } else {

That's a very simple use of tabs.create(), but it should work. There's no incognito option as part of tabs.create: that state depends on what window the tab is created in. That works fine in Desktop since the windowId defaults to the current Window, but I don't know if Firefox on Android supports the concept of "the current window". I know for sure that Firefox on Android doesn't support Window related extension APIs (https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/windows/Window#browser_compatibility).

Looking at the documentation it looks nearly impossible for extensions to properly support private browsing in Firefox for Android since you can't tell if the tab you're manipulating is private or not, you can't explicitly ask for new tabs to be private by specifying a private windowId or even a private openerTabId because that's not supported either. At the very least tabs.create() ought to check whether the CURRENT tab is private or not.

Given that the lack of support for these APIs is documented on MDN this is probably a dupe of a bug to add such support.