2014164 - Suspicious cross-site cookies access from sqlite.org on news.ycombinator.com

Status: UNCONFIRMED

(Core :: Privacy: Anti-Tracking, defect)

Description

[awalgarg]

Attachment: 2026-02-03_19-18-40_589x363.png

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0

Steps to reproduce:

1. Visit news.ycombinator.com.
2. Notice a new "cog" icon in the url bar.
3. Click on it.
4. It shows that sqlite.org is allowed to access to cross-site cookies.

This does not happen on the machine of other users in IRC.

As far as I understand, for this to happen, sqlite.org would have had to send a request to news.ycombinator.com in some manner at least.

Now I'm assuming that sqlite.org would not have done that. I'm also assuming that sqlite.org was not compromised (I don't use any machine which could have faced any TLS compromise). In fact I rarely visit sqlite.org.

I'm not claiming that this is necessarily an issue with Firefox, but I find it odd and suspicious enough that I figured it'd be better to report it than not.

Actual results:

4. It shows that sqlite.org is allowed to access to cross-site cookies.

Expected results:

4. It should not show that or anything like that.

Comment 1

[awalgarg]

FYI https://sqlite.org/forum/forumpost/7072e47726

Comment 2

[Emma Zühlcke [:emz]]

This is most likely triggered by one of our storage access heuristics which are used to unbreak common flows that rely on unpartitioned cookie access.
This is not a security issue, more likely an overly eager storage access heuristic. The site boundary for cookies is intact, i.e. sqlite.org isn't suddently allowed to access news.ycombinator.com's cookies.

Comment 3

[Emma Zühlcke [:emz]]

See https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/State_Partitioning#storage_access_heuristics for more details. I haven't confirmed whether the heuristics are behaving correctly in this case.