CVE-2026-8422: Firefox Android WebExtensions Private Tab Bug Fix

Vulnerability Overview Bug ID: 999944 (CVE-2026-8422) Title: Tabs opened by extensions are displayed as private when they are not Product: Firefox for Android Component: WebExtensions Priority/Severity: P2 / S3 Status: RESOLVED FIXED Core Issue: In normal browsing mode, tabs opened by extensions were incorrectly flagged as being in "private browsing" state. This caused users to mistakenly believe these tabs had privacy protection, although they actually share cookies and session data with regular browsing. Impact Scope Affected Version: Firefox for Android Impact Description: - The property of tabs created by extensions in normal browsing mode was incorrectly set to . - Users may have mistakenly assumed these tabs were in private mode, leading them to store sensitive data (such as cookies and session information) in these "private" tabs. However, this data was actually shared with regular browsing, posing a data leakage risk. - The issue stemmed from the API not correctly setting the privacy flag in normal mode, resulting in a mismatch between the UI display and the actual state. Fix Details Fix Status: Fixed (RESOLVED FIXED) Fix Method: The logic for was modified to ensure that the flag for tabs created in normal browsing mode is set to , and is only set to in private mode. Verification: The effectiveness of the fix was verified through unit tests and integration tests to ensure that the privacy state of tabs is consistent with the UI display. POC / Exploit Code The page did not include a standalone POC or exploit code block, but mentioned relevant test paths and reproduction steps: Reproduction path: Key test file: Test case: New assertions regarding the behavior of in normal/private modes were added in .

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-8422: Firefox Android WebExtensions Private Tab Bug Fix