Skip to content

Conversation

harr1424
Copy link
Contributor

@harr1424 harr1424 commented Oct 3, 2025

🎟️ Tracking

📔 Objective

📸 Screenshots

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

Copy link
Contributor

github-actions bot commented Oct 3, 2025

Logo
Checkmarx One – Scan Summary & Details7b32b432-f8d8-4f65-ac59-2c8dc5677fc2

New Issues (17)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL CVE-2025-10585 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: riymzp7KP7wyZ0CC0CEQsnkZIWF0DWQZXiMKIkpg62k%3D
Vulnerable Package
HIGH CVE-2025-10200 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use After Free in 'ServiceWorker' in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corrupt...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: DeTVvSkhbtyZMYFQv196d5TRa%2BslB4BXa9rGNk108zY%3D
Vulnerable Package
HIGH CVE-2025-10500 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use After Free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Xj3M9QfsrOjPtBpmPV4ovHgaCS9SWmFWGyOfCD%2Bs2zk%3D
Vulnerable Package
HIGH CVE-2025-10891 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: KKHrbfv8MtfwB4cNE2xlWI4Q9TG52SbCY4aIrfvUv1A%3D
Vulnerable Package
HIGH CVE-2025-10892 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Integer Overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: THm%2FGYAgOdpSvKanENrDQ5qdT0h62yimX4gmpZl6WoQ%3D
Vulnerable Package
HIGH CVE-2025-8880 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Race in V8 in Google Chrome through 139.0.7258.126 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: LOW

ID: rH6zKZ5c4dt6Gd3bLpNdl2%2BduMe2fpr4eX6coKH98MI%3D
Vulnerable Package
HIGH CVE-2025-8882 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: RcXRTD9FiqU%2FMlZjH%2BuHobeZ6FVXM%2BVF96iUoRMYsf8%3D
Vulnerable Package
HIGH CVE-2025-8901 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Out-of-bounds Write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out-of-bounds memory access via a crafte...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: nj4KfxRQMEVGHKr3pBm5HZjrJMDXx%2FM8ydZWz15YwN0%3D
Vulnerable Package
HIGH CVE-2025-9132 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Out-of-bounds Write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted H...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ntjgh%2BHfPDcK%2BkifozD6c1y4qkPvtNbTOyUwWWkCQZ4%3D
Vulnerable Package
HIGH CVE-2025-9478 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Uxnl7T2%2FvqXk6qAi4rrWhyylg0KGm%2FkE0hqDG6aJQoA%3D
Vulnerable Package
HIGH CVE-2025-9864 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Use After Free in V8 in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Attack Vector: NETWORK
Attack Complexity: LOW

ID: COxuc5qaoMm2MFMYpOXpHjmYF1QFVZKxCfik%2FFpdJX8%3D
Vulnerable Package
HIGH CVE-2025-9866 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Rjw%2FMHQq%2Bq6F%2BvNSsqwSJlRHAd0LdA1Imqza9ecbpgs%3D
Vulnerable Package
MEDIUM CVE-2025-8583 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in Permissions in Google Chrome through 139.0.7258.65 allowed a remote attacker to perform UI spoofing via a crafted H...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: V0sq6Y2qWcxFeSEUSM9P4sQPBU2zV6dgo6hhb3DMchk%3D
Vulnerable Package
MEDIUM CVE-2025-8881 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in sp...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: pF6J99gcS68wKFY1V9PUKj%2BpJMRhQ2v1dY%2Fd%2Be05fhI%3D
Vulnerable Package
MEDIUM CVE-2025-9865 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in the Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to en...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: A%2FpUbpVMpo1qT64z3rPhe1pU2WyDa16XHryxH8I6iaM%3D
Vulnerable Package
MEDIUM CVE-2025-9867 Npm-electron-36.8.1
detailsRecommended version: 38.2.1
Description: Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: gnRdKCIaEdKNqrDL5rMw%2FZTd2KLsWaLXr4wjUD0%2BmvU%3D
Vulnerable Package
LOW Angular_Usage_of_Unsafe_DOM_Sanitizer /libs/components/src/avatar/avatar.component.ts: 96
detailsUsage of an unsafe class bypassSecurityTrustResourceUrl, which overrides output sanitization, was found at /libs/components/src/avatar/avatar.comp...
ID: p3xM9XJ2b8uXntt84Va4Lt%2BAIkY%3D
Attack Vector

Copy link

codecov bot commented Oct 3, 2025

Codecov Report

❌ Patch coverage is 40.25974% with 46 lines in your changes missing coverage. Please review.
✅ Project coverage is 38.75%. Comparing base (f92eddf) to head (dac8100).
⚠️ Report is 59 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
libs/common/src/tools/providers.ts 9.75% 37 Missing ⚠️
libs/importer/src/components/importer-providers.ts 0.00% 6 Missing ⚠️
apps/browser/src/background/main.background.ts 50.00% 2 Missing ⚠️
libs/angular/src/services/injection-tokens.ts 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main   #16730      +/-   ##
==========================================
+ Coverage   38.27%   38.75%   +0.47%     
==========================================
  Files        3409     3409              
  Lines       97824    96781    -1043     
  Branches    14722    14524     -198     
==========================================
+ Hits        37447    37505      +58     
+ Misses      58747    57634    -1113     
- Partials     1630     1642      +12     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

• remove unused logging methods in import.service.spec.ts
• restore (unused) feature flag support in generator-services.module.ts
• avoid type casting
• clarify doc comments
• PlatformUtilsService.copyToClipboard()
• PlatformUtilsService.readFromClipboard()
• DEPRECATED PlatformUtilsService.showToast()

these methods weren't being used, but in order to avoid breaking anything, I've added them
Copy link

sonarqubecloud bot commented Oct 5, 2025

@bw-ghapp
Copy link
Contributor

bw-ghapp bot commented Oct 5, 2025

Changes in this PR impact the Autofill experience of the browser client

BIT has tested the core experience with these changes and all feature flags disabled.

✅ Fortunately, these BIT tests have passed! 🎉

@bw-ghapp
Copy link
Contributor

bw-ghapp bot commented Oct 5, 2025

Changes in this PR impact the Autofill experience of the browser client

BIT has tested the core experience with these changes and the feature flag configuration used by vault.bitwarden.com.

✅ Fortunately, these BIT tests have passed! 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant