1979918 - (CVE-2025-10535) Swiping between Firefox and custom tab doesn't lock PBM

Status: RESOLVED FIXED

(Firefox for Android :: Privacy, defect, P2)

Description

[Rebeca Tudor]

Steps to reproduce

1. In Setting -> Private browsing -> enable "Use screen lock to hide tabs in private browsing.
2. In Settings -> Set Firefox as the default browser to open the custom tabs in Firefox.
3. Open a private browsing tab and visit some site in that tab, e.g. https://example.org .
4. Switch to another app that can launch custom-tabs, e.g. Gmail, and tap some link to open a custom tab.
5. Swipe back to Firefox.

Expected behavior

PBM is locked and authentication is required.

Actual behavior

PBM is unlocked

Comment 1

[Rebeca Tudor]

Attachment: case2.mp4

Comment 2

[:Gela]

What device are you using? I tested this on Firefox 141.0.1 (release downloaded from the Play Store) on my Pixel 8 using both PIN and facial recognition and I'm not able to reproduce this.

Never mind, I am able to reproduce this too.

Comment 3

[Daniel Veditz [:dveditz]]

Bug 1971361 seems related. Kind of the opposite, so maybe fixing that broke this?

Comment 4

[Rebeca Tudor]

I observed this issue while working on Bug 1971361. The is can be reproduced before and after applying the patch from that ticket. So it's not related to it.

Comment 5

[Mike a [:mavduevskiy]]

Attachment: (secure)

appstate.mode is updated by DefaultBrowsingModeManager during init phase; so that a custom tab is able to rewrite the mode set by the application. Managers calculate mode based on intent correctly, the missing peace was to update the appstate as well.

Comment 6

[Andrei Popa]

The issue was fixed with the patch added in Bug 1980721.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Are older releases affected or did this only affect 143?

Comment 8

[Rebeca Tudor]

142 is affected too.

Comment 9

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:mavduevskiy, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox142 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Very late in the cycle to uplift a sec-low IMO. Feel free to nominate if you feel strongly otherwise, however.