[PM-40883] WebAuthn 2FA: callback cannot return to the app when Firefox is the default browser — Custom Tab lands on the bitwarden.com 404 page

[m00rsa]

Steps To Reproduce

Steps To Reproduce

1. Set Firefox for Android as the system default browser
2. Open the Bitwarden app and log in with the master password
3. On the "Verify WebAuthn" screen, press "Open WebAuthn". The connector
   page opens in an in-app Custom Tab backed by the default browser
   (Firefox), not in the standalone browser
4. Complete the assertion with a YubiKey 5C NFC over NFC

Expected Result

Expected Result

The callback returns to the Bitwarden app and the login completes.

Actual Result

Actual Result

The assertion succeeds, but the Custom Tab then navigates to

https://bitwarden.com/webauthn-callback?data=[REDACTED]

and renders the bitwarden.com 404 page ("It seems you have stumbled into
an empty vault"). Login never completes. Screenshot attached.

The failure is in the return step, not in the authentication.

No app hand-off is possible at that point: the connector runs in a Custom
Tab launched by the Bitwarden app itself, so the App Link cannot resolve
back into the launching app. Firefox's "Open links in apps" setting does
not apply to Custom Tabs, which is why toggling it has no effect.

Screenshots or Videos

Additional Context

Additional Context

Works correctly with Samsung Internet set as the default browser, which is
the current workaround. The default browser matters even though the user
never opens a browser, because it backs the Custom Tab.

Variables ruled out, each tested with a fresh login:

• Firefox "Open links in apps": tested with both "Ask before opening" and
  "Always" — no effect, and no hand-off dialog ever appears
• Firefox desktop-site mode: tested on and off — same failure
• Firefox 152.0.6 and 153.0 — same failure on both
• WireGuard VPN with "block connections without VPN", and a custom DoH
  resolver: tested enabled and disabled — no effect
• Bitwarden app uninstalled and reinstalled from Play Store — no effect

Unaffected on the same account: iOS app, web vault on Windows, Firefox
extension on Windows.

This may be a regression introduced by the fix for #6313. Moving the
callback away from the bitwarden:// custom scheme to an https App Link
makes the return step depend on the Custom Tab implementation of whichever
browser happens to be the system default. Samsung Internet's handles it;
Firefox's does not.

Build Version

2026.6.1 (21713)

What server are you connecting to?

US

Self-host Server Version

No response

Environment Details

• Device: Samsung Galaxy S25 Ultra, Samsung Galaxy Tab S9 SM-X510
• OS: Android 16 - One UI 8.5
• Firefox for Android 153.0 (build 2016172927)

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for your report! We've added this to our internal board for review.
ID: PM-40883

[sshadminBW]

Hi there,

Thank you for your report!

I was able to reproduce this issue, and I have flagged this to our engineering team.

If you wish to add any further information/screenshots/recordings etc., please feel free to do so at any time - our engineering team will be happy to review these.

Thanks once again!

Tracked: PM-40091

[pamperer562580892423]

Tracked: PM-40091

@sshadminBW Is it correct that the PM is different from the one that the Bot gave this issue?

ID: PM-40883

[doveman]

I have the same problem with my Xiaomi Redmi Note 13 Pro 5G phone on Android 16 with the 10 July 2026 version of the app.

If I set the default browser to Chrome it works so I've set it back to Firefox after but non-techy users will just see it fail and think it's broken.

[SolidSonicTH]

Getting this problem too on a Surface Duo 2 running Android 11 (and before you complain about using an outdated Android build, the highest one this device goes to is 12L, which I downgraded from due to a bug, and it did work properly on that as recently as earlier this month, as that's when I got this device for the first time).

It's a stock ROM but I can confirm it happens on both Edge and Chrome as the default browser.

[Tipoff4317]

I got the same problem with Bitwarden 2026.7.0, Firefox 153.0.3 and Samsung One UI 8.5.

[SolidSonicTH]

Seems to be fixed now, at least for me. I was able to log in after the WebAuthn prompt without getting kicked to a 404.

[mvanhorn]

Implemented in #7286.