2028570 - Cookies shared in private windows

Status: RESOLVED DUPLICATE of bug 1856645

(DevTools :: Storage Inspector, defect)

Description

[Bas]

Attachment: firefox_x8TWHbll4X.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0

Steps to reproduce:

1. Open a clean firefox profile
2. Open a private session as well
3. Open google.com on both
4. Open console on both in the storage
5. Go to cookies on both
6. go to google.com on both
7. Either add a new cookie in the private or non private window.

Actual results:

Cookie gets added to both windows. The private and the non private one.
You can also modify existing cookies the same way.

Expected results:

Cookies from the private window should not be accessible from the non private one and vice versa.

Not sure how this could be exploited yet, but just to be certain I've checked the box that many users could be harmed.

Comment 1

[Bas]

Attachment: Demo cookie behaviour

Comment 2

[Bas]

nightly 151.0a1 (2026-04-01) (64-bit) has the same issue.

Comment 3

[Daniel Veditz [:dveditz]]

This is a bug in devtools, but not a security bug where the cookies are actually shared with the web content