-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Description
Describe the bug
I found that when a user closes a tab, the underlying WebView is not fully destroyed and it can still perform network requests and content rendering, even though it's not visible to the user. While the impact of this bug depends on the website being rendered, in some cases it can significantly affect users' devices. One such case is ebay.com, I noticed that its eBay Live streams are being downloaded and rendered for minutes after the tab was closed, which leads to much higher memory, data, and battery consumption compared to browsers that destroy the renderer as soon as a tab is closed.
It seems that the bug was introduced in 5.239, as 5.238 is not affected.
How to Reproduce
- Have a recent DuckDuckGo debug build installed on an Android device. A release build will work too, but it doesn't allow man-in-the-middle attacks, as it doesn't trust user-installed CA certificates. This can be circumvented by installing a certificate to the system store, but it requires a rooted device.
- Have
mitmproxy(run asmitmpdump) running on a machine in the local network. - Configure the Android device to use that proxy.
- In DuckDuckGo on Android, open
ebay.comand scroll down toeBay Livevideos. - Check the proxy log, you should see many requests to
https://live.us.shoplive.cloud/ - Close the tab and open any other website in a new tab.
- Check the proxy log again, you should see more requests are sent to https://live.us.shoplive.cloud/. This will last for a few minutes, unless you close the browser.
Another way to do test it:
- Have a recent DuckDuckGo debug build installed on an Android device
- Enable remote WebView debugging
- Open any website and connect a remote Chromium inspector
- Close the tab and open any other website
- The debugger is still connected, you can call
fetch()to check the outgoing HTTP requests.
Expected behavior
Once the tab is closed - all connections to live.us.shoplive.cloud should be terminated and the WebView should be destroyed
Environment
- DDG App Version: 5.239 and later
- Device: Pixel 9
- OS: Android 15