1993805 - Users cannot tell which extensions desktop/push notifications are coming from

Status: NEW

(WebExtensions :: Frontend, defect, P3)

Description

[Leonardo]

User Agent: Mozilla/5.0 (Android 10; Mobile; rv:144.0) Gecko/144.0 Firefox/144.0

Steps to reproduce:

?

Actual results:

A notifciation from another app, Mihon, is shown from Firefox for Android, a Site notification.

I was seeing a request to open any link in the app Chronometer, so I deleted the data and cache. Now I get this weird Site notification, which seems to be from Mihon that a new chapter has released. This started to happen once I upgraded to 144.0b11 (Build #2016118911) on Android 8.

Expected results:

I do not expect to see notifications from other apps.

Comment 1

[Leonardo]

Attachment: Screenshot of notification.

Comment 2

[Leonardo]

I suspect these are notifications from a website. Clicking on them leads no where. And I can't see anything on the site from the ones where it might be coming from (mangapark, mangafire, not sure which others). I'm at a loss.

Comment 3

[Leonardo]

Thanks 08xjcec48!

My setting for Notifications under Site Settings is set to Always ask. And I don't recall ever allowing a site to send notifications, though... memory... 😅

Comment 4

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:boek, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[Leonardo]

I upgraded to 145.0b9 (Build #2016123503), and it is still present.

Comment 6

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Firefox for Android::Browser Engine' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 7

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Attachment: Screenshot_20251120_215355_One UI Home.jpg

What version of Android is this? Or what phone? Firefox does send the website information which should look like this, it seems the system is not showing it?

Comment 8

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Hmm, I thought we froze the Android version in the user agent string, but apparently we did not, then maybe I can trust comment #0 and it's Android 10.

Edit: but comment #0 also says Android 8... 👀

Comment 9

[Leonardo]

(In reply to Kagami Rosylight [:saschanaz] (they/them) from comment #7)

What version of Android is this? Or what phone? Firefox does send the website information which should look like this, it seems the system is not showing it?

Android 8 on an LG V20.

Comment 10

[Matt Tighe [:matt-tighe]]

Hey :leonardo! Is there any chance the 'Mihon' app is displaying its content in a custom tab? Could you share a screenshot of what it looks like while you're reading from it?

Comment 11

[Leonardo]

(In reply to Matt Tighe [:matt-tighe] from comment #10)

Hey :leonardo! Is there any chance the 'Mihon' app is displaying its content in a custom tab? Could you share a screenshot of what it looks like while you're reading from it?

I don't think that's the case. There's an option to open up the content via WebView, so that to me leads me to believe that a "custom tab" is not being used. I will edit this with a screenshot shortly.

Comment 12

[Leonardo]

Attachment: Screenshot of Mihon app

Comment 13

[Leonardo]

Attachment: Screenshot of Mihon app with modal detail

Screen shot of Mihon app with detail showing web view and open in browser options.

Comment 14

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:boek, could you have a look please?

For more information, please visit BugBot documentation.

Comment 15

[Leonardo]

Oh, can't edit.

Heres two screenshots:

Comment 16

[Leonardo]

I figured out where the notifications where coming from. 😅 They are coming from the extension MAL-Sync, https://addons.mozilla.org/en-US/firefox/addon/mal-sync/.

I disabled the Notification preferences and then stopped receiving these notifications in Firefox.

Comment 17

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

Oops, addons sure don't have the origin information, although it would be nice to have some indication there. Right now the indication is based on the principal origin and extensions don't pass any principal.

cc Rob about that.

Comment 18

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

And that means this is not Android specific. (A bit about Alerts Service, but I think WebExtensions fits better for tracking purpose)

Comment 19

[Rob Wu [:robwu]]

I just tested what happens if we call Notification.requestPermission() on user interaction.
That shows a prompt with a request attributed to the name of the extension.

Then I called new Notification("hello").
That shows a notification "hello" with the hostname (UUID) of an extension. That is not very meaningful to the user.

So even if we were to fix bug 1589693, it would not help with the confusion of this bug. We would have to implement a mapping of extension principal to the extension (name?) similar to how the permission prompt does it.