2049842 - Firefox For Android: private browsing history logged in history by addon: https://addons.mozilla.org/en-US/firefox/addon/search_by_image/

Status: RESOLVED DUPLICATE of bug 1699444

(Firefox for Android :: WebExtensions, defect)

Description

[huynhok.uit]

I use this addon in android and desktop. But the problem only happens on android. When searching image with this addon, histories will be logged, and all tab created by this addon will logged as well even I closed all private tabs on android.

I reproduce with desktop, but no issue, I read source code of this addon and no see what's wrong where addon write history - it cannot write history as Mozilla policies

Step to reproduce:

1. Install addon and android from: https://addons.mozilla.org/en-US/firefox/addon/search_by_image/ ( this recommended by Mozilla)
2. open private tab and search something like: flowers.
3. Choose 1 image and open settings, choose Extensions and choose Search by image
4. Choose some provider like Yandex.
5. Close all private tabs, and check Settings => History. New history in private tabs appeared
6. Reproduce with desktop and confirm that not happen in desktop.

Comment 1

[Tyson Smith [:tsmith]]

The rating assigned by our bug rating tool (currently under development) is:

Rating: sec-moderate

Explanation: Valid private-browsing data leak on Firefox for Android. Verified in code: GeckoView's WebExtension.CreateTabDetails (passed to TabDelegate.onNewTab for tabs.create()) carries no private/incognito flag (WebExtension.java L717-773); GeckoWebExtension.onNewTab forwards only active+url; WebExtensionSupport.openTab calls createTab(url) which defaults private=false (TabSessionState.kt L89-91). Thus tabs opened by an extension from a private context are created as normal tabs and their URLs are written to persistent, UI-visible history (Settings -> History), explaining why the reporter sees private-session search URLs persist and why Desktop (which propagates incognito state) is unaffected. This maps to the sec-moderate example 'Private Browsing Mode data leaks discoverable in the Browser UI' - it is more than a transient disk leak since the data is recorded as visible browsing history. Preconditions (install extension, allow in private browsing, use a tab-opening extension) limit affected users but are normal usage and the leak is reliable once met; could be argued down to sec-low given the mobile carve-out, but the UI-discoverable persistence supports moderate. No screenshots/videos required review; mechanism confirmed in source.

Comment 2

[huynhok.uit]

Can I request CVE for this issue?

Comment 3

[huynhok.uit]

Hi team. Any update for this report?

Comment 4

[Rob Wu [:robwu]]

This is a duplicate of bug 1699444. We should really fix it...

Comment 5

[Rob Wu [:robwu]]

I also found that this issue was reported before, buried in a comment in bug 1870978 - https://bugzilla.mozilla.org/show_bug.cgi?id=1870978#c11