2

I am a long-time Firefox user and remember that usually the UAC prompt popped up when Firefox updated itself. Some months ago (or is it years?), Firefox obviously changed the way it updates itself: I didn't see the UAC prompt since then in such situations. The updates were performed as expected, though. So far, so good.

Several weeks ago, I decided to lock down my systems further. One of the most important steps involved was to remove the user account I normally work with from the Administrators group. That had less impact than I had expected (and hence was the right step which I would recommend to everyone), but it led to an interesting problem with Firefox:

Firefox offers updates for itself as usual via popup at the right top of its window. When I click "Update" in that popup (the blue button), it pretends to do something, and even the new page where the improvements are listed or further features are advertised opens as usual.

However, the "update" runs surprisingly fast, and I am not asked to restart Firefox afterwards. Consequently, Firefox is not being updated during the process. I am considering this a sensational security breach, and it does throw a bad light onto Firefox development and quality management.

Steps to reproduce:

  • Install a three-month old version of Firefox as administrator
  • Use Firefox in a user account which is not in the Administrators group
  • Wait until Firefox offers an update
  • Accept the offer, i.e. click on the blue button "Update"
  • Observe that Firefox pretends to update itself and even opens a new page in a new tab which advertises Firefox's advantages or the new features (this is the point where a normal user believes to have installed the newest version and to be safe)
  • Restart Firefox and observe that it did not perform the update, e.g. via Help -> About Firefox (which shows that it is still the old version which is installed)

I am asking myself whether I should trust Firefox any more given that they are not even able to implement the most important, yet most simple, security mechanism correctly, i.e. the update mechanism. Even worse, it doesn't fail with an appropriate error message, but pretends to have done the update, where in fact it didn't, misleading non-expert users and putting them seriously at risk.

Did I misunderstand something? What am I missing?

Update #1

In the comments, Moshe Katz has pointed out that the Mozilla Maintenance Service must run to enable updates as a non-administrator. I knew that this service had been installed (I remembered it from the installation where it asked for it), but checked again and was surprised that it was installed, but it was not running, and its startup type was set to Manual.

I made myself administrator, changed the startup type to Automatic and tried to start the service. This led to a dialog box with the following error message:

Windows could not start the Mozilla Maintenance Service service on Local Computer.

Error 1: Incorrect function

Obviously, my Firefox installation somehow got screwed, and I can't start the Maintenance Service. I'll now try to reinstall only the maintenance service; if this is not possible, I'll reinstall Firefox.

4
  • 2
    Perhaps there was a bug in that particular version, or there is something wrong with your setup that is breaking it. Either way, I'd manually update to the latest version and move on. – multithr3at3d Sep 28 '20 at 2:20
  • Thanks for the comment - I'll do so. For me personally, this isn't a problem at all, because I routinely double check the version number after any update of any software, and of course, I have installed the update using an administrator account. However, the reason why I wrote this question was to bring that problem to others' attention, and to have it confirmed. I do not believe that there is something wrong with my installation. For the record: This happens e.g. with the update from 80.0.1 to 81. – Binarus Sep 28 '20 at 5:57
  • 1
    Did you check if the "Mozilla Maintenance Service" is running? This service is how Firefox can update without admin privileges. – Moshe Katz Sep 29 '20 at 18:35
  • Thank you very much. It seems that this brings me closer. Please see my update #1 in the question. – Binarus Sep 30 '20 at 6:27
0

As far as I know Firefox updates when you close and restart the browser.

What happens normally for me is that I download the FF update when it proposes this in the browser. When done with my browsing session I close FF and restart it. Then you should see a window with a loading bar displaying FF being updated. When that is done, it launches the browser with the message of the new version.

2
  • The problem is that exactly this does not happen when I work with an account which is not part of the Administrators group. Did you try that? It is the key point of my question. – Binarus Sep 26 '20 at 14:57
  • Yes I did update with a non-Admin account. – VGC3OCJA50 Sep 27 '20 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.