Firefox 134.0 blocked by Defender, needs Controlled Folder Access!

[Animaitor]

After updating Firefox to 134 from 133 I get a Defender message warning me firefox.exe is trying to access %userprofile%\Documents It happens after a few minutes of opening Firefox and it doesn't matter what site I have opened. I already restarted the PC and get the same behavior.

Am I the only one? What changed from the previous Firefox version to the new one?

[fidodido]

Hi, haven't any updates myself manually, but the last 3-4 days same things happens to me.

[Animaitor]

Well, good to know I'm not the only one.

@fidodido, what version of Firefox are you running?

[fidodido]

134.0

[qw]

Same here. Firefox version 134.0

[CJatWork]

Same here the last few days since updating to 134.0 but just updated to 134.0.1 as I was composing my post, so we'll see if there's a change.

[update-1] 24 hours since updating to 134.0.1 and I have not seen the message from Defender pop up.  I visited many sites in my history from the previous few days, didn't trigger anything.  Doesn't mean the update fixed it; I'm just reporting it hasn't happened since.

[Animaitor]

I'm at work and I don't want to update to 134.0.

I'll install 134.0.1 once I get home tonight and I'll report back if they fixed this problem.

[grundt]

(oops, replied to wrong post and can't delete ... see below)

[l2eused]

same here, firefox 134.0.1

[CJatWork]

I updated my post to include the fact that since updating to 134.0.1, I've not had any Defender pop up messages.  But it seems I2eused has the same issue in spite of having the latest update.  Curiouser and curiouser. 🤔

[Animaitor]

I can confirm that with 134.0.1 the Defender warning is gone.

[CJatWork]

I'm getting the Defender warning again.  Still wants access to the Documents folder.

[Animaitor]

Do you keep any tabs open? How about add-ons?

In my case, I do keep many tabs open and have 4 activated add-ons. Still no Defender warnings.

[CJatWork]

I don't keep any tabs open, nor do I have any add-ons.  The warning popped up again just now.  I followed the link from the notification email regarding this thread, Firefox opened to this page and seconds later I get the Defender warning.

[Animaitor]

Wow, that's bizarre. It must be something very few people experienced or reddit, youtube, etc would've been full of thread talking about it.

It's obvious Firefox team doesn't know about it or ignores this problem completely.

I have found a few threads about this matter, one on reddit the other on some forum but no real fix found or reason as to why this happens.

https://www.askwoody.com/forums/topic/firefox-134-needs-controlled-folder-access/

https://www.reddit.com/r/firefox/comments/1hwvtp2/why_the_new_ff_134_wants_to_see_my_personal/

[CJatWork]

Thanks for the links.  I was rocking v133 for a few days.  No Defender pop ups so it's definitely v134+, at least for me.

Switched back to 134 but noticed it is now 134.0.2 not the .1 than I last used.  While doing this back and forth switch, I screwed up my profile.  Got that all squared away and the pop ups are gone; this is day 2, many hours of running the browser.  Fingers crossed.

But now the question is, was it the version update or the process of creating a new profile?  That brings up another question... will a simple refresh fix the problem for a person who is still experiencing this?  Someone will correct me if I'm wrong but I believe a refresh is a simple way of creating a new profile and copying all your bookmarks, history, passwords, etc. to the new profile.  I just did it the hard way, heh-heh.

[Ulmo]

I've just installed the latest version, 137.0b2, and it also tries to access %userprofile%\Documents. I don't allow it via defender, and I haven't noticed any consequential problem, but the pop-up is quite annoying. Please Mozilla, what are you doing, why do you try to access this folder and its files?

[CJatWork]

I'm still at 135, about to update to 136.  I've had the popup return only a couple times since it settled down.  I'm wondering now if we could be barking up the wrong tree.  If you open a tab and enter file:///C:/Users/<your profile name here>/Documents  as the URL, you can see and access the files in your Documents folder.  How is that not allowing Firefox access to the folder already?  Maybe Firefox is trying with a protocol other than "file" OR... is this a problem with Defender falsely blocking Firefox?  Maybe we should be yelling at Microsoft for a fix?

[Ulmo]

I don't know, complete mystery. Fact is that the profile folder is in %appdata%\Local\Mozilla\Firefox\Profiles) (and then some in \Roaming\Mozilla\Firefox\Profiles), not in %userprofile%\Documents. I haven't seen any bug nor oddities as I keep it blocked (the Defender warning appears every time, a minute or so after I open the browser). Hence I won't allow it, but it's weird and annoying.

[grundt]

according to this article: How does controlled folder access work? 
"Apps ... are prevented from making any changes to files inside protected folders", which explains why the (readonly) file: protocol wouldn't trigger a violation

[CJatWork]

Thank you, grundt, for the link.  I see your point and I can't disprove it BUT... I could do the same and play off highlighting a different word.  "Controlled folder access works by only allowing trusted apps to access protected folders."  If the goal is file protection, you don't want malware/ransomware to even read your files.  That said, I have no idea what protocols are allowed/blocked anywhere, I'm just interpreting the same information from another direction.  Doing that, in addition to the fact that through the last several updates I have not seen the popup, I'm going to keep my stack of chips on "Defender false positive". 😏

[grundt]

Your discovery that the File: protocol wasn't being blocked (it surprised me) is what prompted me to seek out an explanation in the first place.   I mean, after all the name of the feature itself suggests that it blocks access.
But here's another article ( this one from Eric Lawrence, a former Microsoft employee and the creator of Fiddler, if you happen to be familiar with that tool ) explaining the nuts & bolts of Controlled Folder Access.
See the paragraph titled How?, where he explains that the way it actually works is by intercepting and stripping the write permission from folder access requests.

[Qubo]

I have the same problems with both Firefox and LibreWolf. I assume it has something to do with Firefox's new privacy policy.

[grundt]

Two weeks ago I set browser.backup.enabled to false (in about:config) and haven't had the issue since.

The way I discovered that particular setting was by browsing the the gecko github repo, looking for places that were using the Documents folder.   I found a couple of comments mentioning that the Documents folder was a default:

• github - BackupService.sys.mjs#L699 
• github - backupSettings.ftl#L215 

and then found the setting needed to override the default (which is browser.backup.location) :

• github - BackupService.sys.mjs#L22 

But because I didn't know what format was necessary for the "browser.backup.location" setting, and had spotted the "browser.backup.enabled" setting, I just changed that to false and it seems to have done the trick.

And btw, I have no idea what this whole "backup service" feature is ... I couldn't find it documented anywhere.

[CJatWork]

Nice.  I'm going to keep this one on file.  If it acts up again, I'll give it a try.