2012012 - (CVE-2026-2803) “Require device sign-in to autofill and manage payment methods” checkbox's state can be changed even when device authentication is cancelled

Status: VERIFIED FIXED

(Firefox :: Settings UI, defect)

Description

[Skywarp]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0

Steps to reproduce:

1. Open Firefox Settings
2. Go to Privacy & Security → Payment methods
3. Click the “Require device sign-in to autofill and manage payment methods” checkbox once
4. Wait for the device authentication prompt (Windows) to appear
5. While the authentication prompt is still open, return to Firefox and click the same checkbox a second time
6. Cancel or close the device authentication prompt

Actual results:

After cancelling or closing the device authentication prompt, the checkbox changes state, even though authentication was not completed.

Expected results:

The checkbox state should only change after successful device authentication.
If authentication is cancelled or closed, the setting must remain unchanged.

Comment 1

[Skywarp]

Attachment: Video proof of the bug

Comment 2

[:Gijs (he/him)]

Micah, can you take a look?

Comment 3

[:Gijs (he/him)]

Does the changed checkbox state actually persist after a reload and/or lead to changed behaviour (i.e. do we actually stop/start prompting for Windows auth when filling payments) ?

Comment 4

[Skywarp]

(In reply to :Gijs (he/him) from comment #3)

Does the changed checkbox state actually persist after a reload and/or lead to changed behaviour (i.e. do we actually stop/start prompting for Windows auth when filling payments) ?

Yes.
The changed checkbox state does persist after reloading settings and after restarting Firefox.
After disabling the checkbox via this issue and restarting Firefox, Windows device authentication is no longer required when accessing or autofilling payment methods.
The behavior change is persistent and not limited to the current session.

Comment 5

[Micah [:mtigley] (she/her)]

I suspect the issue may be here. We are still setting the opposite value of the current state of the checkbox without authorization.

Comment 6

[Micah [:mtigley] (she/her)]

Attachment: (secure)

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/611ebe23e36f
https://hg.mozilla.org/integration/autoland/rev/1290f6404c39
Don't set OS auth for payments if user isn't authorized. r=dimi

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/1290f6404c39

Comment 9

[Donal Meehan [:dmeehan]]

:mtigley, please add a beta uplift request when you have a moment

Comment 10

[Micah [:mtigley] (she/her)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D280347

Comment 11

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: “Require device sign-in to autofill and manage payment methods” checkbox's state can be changed even when device authentication is cancelled

• Code covered by automated testing: no

• Fix verified in Nightly: no

• Needs manual QE test: yes

• Steps to reproduce for manual QE testing: Steps to reproduce:

  1. Open Firefox Settings
  2. Go to Privacy & Security → Payment methods
  3. Click the “Require device sign-in to autofill and manage payment methods” checkbox once
  4. Wait for the device authentication prompt (Windows) to appear
  5. While the authentication prompt is still open, return to Firefox and click the same checkbox a second time
     Cancel or close the device authentication prompt

Actual results:
After cancelling or closing the device authentication prompt, the checkbox changes state, even though authentication was not completed.

Expected results:
The checkbox state should only change after successful device authentication.
If authentication is cancelled or closed, the setting must remain unchanged.

• Risk associated with taking this patch: low
• Explanation of risk level: Small change in code
• String changes made/needed: no
• Is Android affected?: no

Comment 12

[Micah [:mtigley] (she/her)]

Hi Alin, would you be able to verify the fix on the latest Nightly? Thank you!

Comment 13

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/df6f2e295b28
https://hg.mozilla.org/releases/mozilla-beta/rev/b0688001291b

Comment 14

[Alin Ilea, Desktop Test Engineering]

Reproduced the issue in release 147.0.1
Verified - Fixed in Nightly 149.0a1 (build id: 20260127212501). The checkbox state only change after successful device authentication.
Will verify it in Beta 8 as well, as soon as it's ready.

Comment 15

[Alin Ilea, Desktop Test Engineering]

Verified - Fixed in Beta 148.0b8 (build id: 20260128090352).