Firefox 134 needs Controlled Folder Access

Topic

New Reply

[Bob99]

This post contains a lot of info, so please read the entire post before responding. Thanks for your understanding.

Ever since updating from Firefox 133.0.3 to Firefox 134 via the built-in updater, I’ve been getting notifications from Defender that Firefox is being denied access to C:\Users\(my user name)\Documents because that folder is a protected folder.

This happens about five to ten minutes after Firefox has been started, and happens no matter what is being displayed in Firefox, be it a blank page (about:blank) or a page from AskWoody. It even happened a few minutes after I started Firefox and went directly to the about:config page!

This has occurred on two identical machines and has only happened after the update from 133.0.3 to 134. The Firefox installation on both machines is identical, with NO add-ons, extensions, or themes either installed nor activated if they came with Firefox. Both machines are Windows 10 22H2 x64 Pro fully updated to include the December patch.

Both machines have had full scans with Defender AND Malwarebytes 5.2.4.157 Free, both suites having been updated with their latest definitions. Also, both machines have undergone the Defender Offline Scan that occurs after enabling the offline scan within Defended that immediately reboots the machine to do its scan. ALL scans came back squeaky clean.

So why would Firefox suddenly need access to the Documents folder in my Windows profile when it never needed it before?

Has anyone else been experiencing this behavior recently?

I’ve never saved any downloaded files to that folder because I always download files to a separate folder just for downloads, and that separate folder is listed as the default location in my Firefox installations. That separate folder for downloads is NOT contained within my Windows profile folder whatsoever.

I’ve pored through all the settings I can think of in about:config trying to find a cause, but to no avail. Internet searches have turned up nothing more than information on how to add Firefox to the list of programs that are allowed access to the controlled folders, which I’m not interested in doing unless I know exactly why it needs access where it never needed access before.

For now, I have changed the notification settings within Defender so I don’t see the notifications any more, but I’d rather stop Firefox from trying to access the Documents folder unless I attempt to save a downloaded file in that folder on purpose.

Changing from Defender to another solution is a complete non-starter, so please don’t go there.

Thanks for any suggestions aside from changing from Defender to another solution!

Moderators, please feel free to delete any replies that don’t contribute to this topic or which are already explained in this initial post.

 

• This topic was modified 4 months, 1 week ago by Bob99.
• This topic was modified 4 months, 1 week ago by Bob99.

Reply | Quote

Replies

As I understand it, controlled folder access is off by default. Or at least that’s the state I found it in on my virtual machine and on a family member’s PC, with neither of us having ever touched that setting before.

So, as a test, I turned that security feature on and then fired up Firefox 133.0.3 (as I hadn’t updated yet) and browsed around normally. No notifications about denied access to Documents (or anything else). Then I updated the browser to 134 and did some more browsing. Still no notifications.

Then I checked the default settings for which folders are protected by controlled folder access, just to confirm it was already including the Documents folder.

Oh, and I’ve also got Win10 22H2 x64 with December’s updates.

So, what you’re experiencing doesn’t seem to be the norm. I’d suggest creating an additional Firefox profile with completely default settings. Make it the default profile temporarily, exit the browser, and fire it up again for some testing to see if that trouble persists. Don’t run both profiles at the same time, as it wouldn’t be obvious which is triggering the Windows security notification. Managing the profiles can be done in about:profiles.

2 users thanked author for this post.

Bob99, satrow

Reply | Quote

Well, to add a bit of muck to the already-cloudy picture, I tried using three different installations of FF134 portable with different settings in their individual self-contained profiles from very strict for tracking protection and several modifications to the settings in about:config in one installation to the third installation that has only been slightly modified after being installed from scratch to only restrict the most blatant trackers and the worst of cookies, and they ALL exhibited the behavior of wanting access to the Documents folder in my Windows profile.

Another part of this behavior that I’ve noticed: This only happens the first two times that the particular copy of FF is launched in a 24 hour period. For example, yesterday it happened twice between 11:30 and 11:55 am and today it didn’t happen at all until after 12:00 noon. The portable installations hadn’t been used in about a couple of weeks, so they showed the behavior a few minutes after being launched post-update from 133.0.3 to 134.

I’m using the portable versions so I don’t have to muck around creating a new profile, I can just dump them and their directories and start from scratch with a new installation, leaving my “daily driver” installation intact.

 

Reply | Quote

SB9K wrote:

No notifications about denied access to Documents (or anything else). Then I updated the browser to 134 and did some more browsing. Still no notifications.

You have to make sure that notifications for that category of event are enabled in Defender.

Open Defender and click on Virus & threat protection. Now, click on “Manage settings” under the”Virus & threat protection settings” listing. In this new window, scroll down to the bottom and under “Notifications”, click on “Change notification settings”. The box labeled “Files or activities are blocked” should have a check mark in it and the slider that says “Get informational notifications” should be “ON”.

The easier way to see if FF has been blocked by Defender is: On the Virus & threat protection page, just under the grey button labeled “Quick scan” there’s a listing in blue that says “Protection history”, Click that and you’ll see a listing of anything that’s been blocked by Controlled Folder Access.

Reply | Quote

Yeah, nothing showed up in the history, sorry.

Oh, and all notification settings in Defender were already on, as they are by default.

1 user thanked author for this post.

Bob99

Reply | Quote

I use Sysinternals Process Monitor to capture events for FF 134.0 in a Win 10 22H2 VM.  Controlled folder access was not enabled.  I noticed that merely starting/stopping FF did not result in any file system access attempts to the Documents folder.  However, if I opened FF’s settings there were numerous accesses that seemed to be associated with getting information about the shell’s known folders, which include the Documents folder.  The events logged included opening the hidden desktop.ini file for read access and reading the attributes of the Documents folder.

1 user thanked author for this post.

Bob99

Reply | Quote

I ran into the same issue after updating to Firefox 134, getting those notifications every time I opened or used the browser. I decided to try restarting the PC, and after that, no more notifications from Controlled Folder Access.

1 user thanked author for this post.

Bob99

Reply | Quote

Just an update for everyone: I haven’t had FF ask for access since the 9th, and I have noticed something else with the behavior. It has stopped after occurring the first four times each copy of the browser was opened. This behavior persisted even after restarting the computer on both computers. It only seems to have stopped after having started Firefox more than four times.

So, basically, it happened the first four times I started each distinct copy of Firefox 134.0, but hasn’t happened since then.

Let’s see what happens with the next update that takes FF to version 134.0.1 or higher…will the behavior return or won’t it?

On what might be a related note, there’s a report of someone getting “stuck” on 133.0.3 after being told that the update to 134 was available by FF’s built-in updater. However, after some time, they uninstalled FF (including their profile files) and reinstalled and wound up with FF134 after all. Could it have been that Mozilla realized there were issues with 134 and wound up suspending its distribution for a while to get those issues fixed? We’ll never know for sure. The story line of this can be found starting with this post (in another thread) and going down for the next three posts below it.

Reply | Quote

Bob99 wrote:

Let’s see what happens with the next update that takes FF to version 134.0.1 or higher…will the behavior return or won’t it?

After updating to 134.0.1 earlier today, the behavior returned about three or four minutes after the browser restarted at the end of the update to 134.0.1.

I have kept FF running since then and it hasn’t reoccurred yet.

@EricB, thanks for the proverbial peek under the hood to see just what’s going on. It sounds like this behavior is a new, normal part of what FF does at some point just after it starts or after going into the settings screens. However, in my case, it’s never happened with the settings screens on display, save for the time I was in the about:config file, trying to find an answer early on.

Reply | Quote

I am getting the exact same behaviour on a Win10 machine.

Windows Defender blocks access to my documents folder despite me NEVER using that folder for anything related to Firefox or even keeping *any* of my own documents in there.

Oddly enough, I have the same FF134 installed on a Win11Pro machine right next to it, and no problem.

I ran Windows Defender scan on the Mozilla folder – all clean. Don’t use any usnuaul extensions.

Reply | Quote

I also get the same issue with Firefox, it’s been present for a little while now. I’m up to version 135.0

Same scans for anything malicious and nothing is found. My Firefox setup is a little grandiose though, with many changes made to about:config and at the very least one not very common extension, so I can’t rule out the possibility of having a misconfiguration somewhere.

That said, there are sparse few talking about this issue but for all of us the common denominator is it began with version 134. I have not tried yet but one user said he made it go away by resetting his Firefox user profile.

Reply | Quote

I am getting this behavior on a newly formatted Windows 10 22H2. Additionally, it is trying to access my folders that have been redirected to OneDrive for backup. This computer was installed from scratch on 2/26 and in the 1-2 days, firefox.exe has tried to access “%userprofile%\OneDrive\Documents” 12 times, and “%userprofile%\Favorites” 3 times.

Out of curiosity, what addon’s do those of you that are encountering this have installed? Do you still see this issue with all addon’s disabled?

Reply | Quote

Basic run of the mill privacy enhancing extensions preventing fingerprinting and trackers although I probably take it a bit further than necessary. My browser can be uniquely fingerprinted anyway due to a few settings I change in the about:config area related to aforementioned things. Any sort of disruption I can cause advertising trackers is good enough for me, even if it’s nothing more than being a nuisance.

To answer your question though the behavior also occurs in safe mode with all extensions disabled. An update made the issue at hand go away, then updating again to version 136.0.4 (current as of posting), made the problem return.

Perhaps checking into whatever commits were applied between the two versions of Firefox might reveal more insight as to what it’s attempting to do.

This is also on a freshly installed Windows 11 24H2 build with all security and QOL updates applied.

I switched to Librewolf since Firefox is currently undergoing a bit of a scandal involving their new TOS in regard to selling user data. Librewolf is a fork of Firefox so I was not surprised to find that it is also exhibiting the same behavior as Firefox trying to access Documents and throwing the same Controlled Folder Access block with Defender.

I think this issue is a little more wide spread then many people credit it for since Controlled Folder Access is disabled in Defender by default. Most typical end users would leave it that way since CFA interferes with almost every piece of software imaginable. End users would just find it annoying.

In any event it is slightly concerning to find recent changes made to Firefox’s terms of service in regard to collecting private data and selling it just happen to coincide with Firefox’s sudden desire to attempt to access an area of the file system where users would be likely to have some personal things saved. It could be completely unrelated, but just smells fishy.

Reply | Quote

Art Incognito wrote:

… Firefox is currently undergoing a bit of a scandal involving their new TOS in regard to selling user data …

On that subject, see The Verge’s 28-Feb-2025 Mozilla is already revising its new Firefox terms to clarify how it handles user data and TechCrunch’s 03-Mar-2025 Mozilla rewrites Firefox’s Terms of Use after user backlash for additional details.
———–
Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.5608 * Firefox v136.0.4 * Microsoft Defender v4.18.25010.11-1.1.25020.1007 * Malwarebytes Premium v5.2.9.176-129.0.5196 * Macrium Reflect Free v8.0.7783

Reply | Quote

I’ve had the sames issues with Firefox and thought it might be related to their new privacy policy.

I tried Librewolf thinking it might be different but the issues remain. Both browsers are now trying to access %userprofile%\Downloads, %userprofile%\Favorites and %userprofile%\Documents.

Reply | Quote

It seems that Firefox accessing these locations is nothing new. For example, here’s a Reddit post from over 7 years ago where someone reported similar notifications. Only, that user knew they triggered it by their choice to manually turn on Controlled Folder Access.

I would suspect the recent change in behavior is in Windows Defender, not Firefox.

Reply | Quote

For those that are interested by enabling Windows built-in audit capabilities to log file system access to specific folders/files (i.e., Documents, Downloads, Favorites, etc.) the system’s Security log can show what firefox is doing with these items.  I don’t use Controlled Folder Access but did briefly test file system auditing before posting this.

Reply | Quote

Sorry for the late reply, I don’t usually participate in forums… anyway the security audit log sadly provided no additional insight at all and provided the exact same information as located in the CFA subsection of Defender’s GUI (date/time/executable/path).

Since there is no specific file that Firefox attempts to access I can only come to the conclusion that Firefox is attempting to discern the contents of the Documents folder itself, though I am speculating as I can find no concrete information about what Firefox is doing. I did run across a forum post on Mozilla support about this topic which began this January. After four months of a small amount of users keeping the thread alive Mozilla still has not provided an official response or acknowledged that these access attempts are occurring.

I was actually trying to ignore it until I noticed something today that I hadn’t before, but either a CMD or Powershell window is executed just moments before the CFA notification goes off. It’s so fast I’m really not surprised I never noticed it before.. I just recently got a high refresh rate monitor, and that may be what has allowed my now aging vision to catch that little technological slight of hand. I’m usually only looking for that when dealing with sketchy software which I have VMs for and wouldn’t use on my production system.  Firefox doesn’t fall into that category so I’m not always giving it the hawk eye glare. Naturally that made me re-scan my system for malware which continues to come up squeaky clean, and online verification is reporting 100% system integrity so I’m really at a loss.

Anyway I have a feeling I’ll be digging through logs for a while trying to track that down, if I turn up anything I’ll report back. Can anyone else experiencing the CFA issue with Firefox confirm a very quick flash across their screen occurring moments before the notification goes off? It does occur to me that the flash on my screen could be related to windows notifications or defender also.. or I could finally just be losing my sanity.  All of these are plausible.

TLDR; Security audit log doesn’t reveal any additional information. Began noticing odd flash occur with HDR enabled and a 165hz refresh rate just before notification pops. Uncertain if flash is related to whatever Firefox is doing or something in Windows notification.

Reply | Quote

If it’s powershell, Event Viewer > Applications and Services Log > Windows Powershell will show exactly what it’s doing.

Here’s the event log entry for a powershell script I just ran.

Unfortunately, cmd events don’t get logged.

Reply | Quote

I’ve been experiencing the same message from Windows Defender about Firefox trying to make changes to that folder. It means Defender is doing its job of protecting your computer. Instead of getting rid of Defender, get rid of Firefox!!

Reply | Quote