Password Manager search exposes password content via filtering despite redaction
Categories
(Firefox :: about:logins, defect)
Tracking
()
People
(Reporter: filip, Unassigned)
Details
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0
Steps to reproduce:
- Open Firefox Password Manager.
- Locate a stored login entry for testing (e.g., site abc.test with password password12345).
- Click the search bar in the Password Manager.
- Type a partial or complete password from that entry (e.g., password1234).
- Observe that the login entry for abc.test appears in the search results.
- Note that the password field is still visually redacted, but the entry is returned because the search matches the hidden password value.
Actual results:
You can partially discover a password without ever unmasking it. This poses a risk for users who are sharing their screen and assume their password will remain hidden. An attacker could use this to confirm parts of a password, making it easier and faster to guess the full password.
When testing, it did not occur on my phone (android), only on the desktop Firefox 147 version.
Expected results:
The search feature should not index stored passwords by default.
|
||
Comment 1•22 hours ago
|
||
The Bugbug bot thinks this bug should belong to the 'Firefox for Android::Logins' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
Description
•