Extensions unreliability at browser startup time

[grahamperrin]

Screen recording:

Environment

root@momh167-gjp4-8570p:~ # date ; uname -v 
Sat Sep  7 10:39:13 BST 2019
FreeBSD 13.0-CURRENT r351708 GENERIC-NODEBUG 
root@momh167-gjp4-8570p:~ # pkg query '%o %v %R' firefox
www/firefox 69.0,1 FreeBSD
root@momh167-gjp4-8570p:~ # 

Thoughts

The effectiveness of extensions such as Malwarebytes Browser Guard might be limited – in Firefox and the like – by this Mozilla bug:

• 1378459 - (webextensions-startup) [meta] Allow some addon functionality to load prior to any content loading

From https://bugzilla.mozilla.org/show_bug.cgi?id=1378459#c51:

Quote

In essence: it seems that the content (the … frontmost tab) loads before the extension can take effect.

 

[exile360]

Greetings,

Thank you for documenting this issue.  I will inform the Product team of the issue.

Please let us know if you have any additional feedback or issues.

Thanks

[grahamperrin]

Thanks.

At the time of the first screen recording the Firefox profile was heavily extended, and the machine was under heavy load.

I wondered whether 'excess' load increases the likelihood of this type of issue. As far as I can tell, loads are not a factor.

With a different profile – Malwarebytes Browser Guard alone – and just one page, the issue is consistently reproducible:

Tested: https://mozilla.logbot.info/firefox/

[exile360]

It sounds like it is an issue that the developers of Firefox will have to address unfortunately, however I'm no developer so I can't say for certain one way or the other, but hopefully Malwarebytes' Developers will be able to do something to correct the issue in the browser extension.

[AdvancedSetup]

Obviously this would require a lot more investigation as you're launching from a method that no regular user would do. You also have to deal with caching. In general very little new content is loaded for a cached page.  The product has almost non existent testing on any flavor of Linux aside from a couple of users.

The image on top right is not an Ad it is a browser push entry so if you disable that in the setting it should not show up anymore.

I'll leave it up to the Developers here and Mozilla if it really is a bug or an issue. For myself (and would suspect many or most users) unless you have a very heavy laden Ad monetized webpage as your home page that you would not experience this issue. I have only been using the extension myself for a couple weeks and have not attempted to dig in and break it or look for exploits.

Thank you for the continued feedback though, greatly appreciated @grahamperrin

 

[grahamperrin]

6 hours ago, AdvancedSetup said:

you're launching from a method that no regular user would do.

OK, here's a much simpler workflow that should be easy for regular users to understand:

1. before starting Firefox
2. use an e-mail application
3. click a link.

The symptoms are consistently reproducible:

[grahamperrin]

7 hours ago, AdvancedSetup said:

Linux

FreeBSD is not Linux.

I'll test on Linux (probably Manjaro), and on Windows 10. In the meantime … defocusing from Malwarebytes Browser Guard, I have seen this type of issue often enough, on multiple platforms (including Windows 7 and Linux) for me to guess that it'll be easily reproducible with – for example – Microsoft Outlook 2016 and Firefox Quantum.

[AdvancedSetup]

Symantecs to me. I was a Unix Admin over 30 years ago but Windows was coming on strong and the pay was much higher so I left Unix behind and haven't looked back pretty much since. Though due to ongoing Windows issues I'm seriously considering running Qubes and just run Windows on virtual to support users as I'm approaching retirement before too long.

The developers will check into your report.

Thanks again

 

[grahamperrin]

Thanks again.

As promised, a test result (the first) on Manjaro Linux, Firefox 69.0:

The usual workaround. To discover whether a non-blocked page (or non-blocked content) should have been blocked:

• reload

[grahamperrin]

On 9/8/2019 at 3:32 AM, grahamperrin said:

… I have seen this type of issue often enough, on multiple platforms (including Windows 7 and Linux) for me to guess that it'll be easily reproducible with – for example – Microsoft Outlook 2016 and Firefox Quantum.

Confirmed.

Steps:

1. with Firefox not running
2. in Outlook, click a link that refers to content that should be blocked.

Expected:

• the block.

Actual result:

• the content, not blocked.

A screen recording, made yesterday morning:

[grahamperrin]

Cross reference https://forums.malwarebytes.com/topic/255360-mbg-for-firefox-for-android/?do=findComment&comment=1354719 (Android, unsupported).