Loading youtube.com opens a new tab + youtube.com (...sidebar)

[nn23]

Hello

thank you for this excellent Browser Extension!
Since today I experience a strange behaviour:

First erverything seems normal, until I open Youtube. It doesn't matter if it's a Favorite, or if I type it into the adress line.
Instantly after Fav Icon click (or pressing enter after typing it in, or simlpy press F5 while using YT) a new tab appears, and closes itself instantly.

From now on, until I close all YT tabs, Noscript shows the line "youtube sidebar" in every tab I have opened (whatsapp, everywhere).

- I reinstalled Noscript
- restartet PC
- Firefox is UpToDate
- Made a new Firefox profile
- Disabled all other addons
- All the same.

- It stops if I select "Allow scripts gobally", or disable NoScript in FF Settings. As soon as I enable it, it starts again doing this.

What is this?




Thanks and have a good one!

Alex

[barbaz]

Not seeing this here in a quick test.

What version of NoScript are you using?
Does "Disable restrictions for this tab" have any effect on this issue?

Instantly after Fav Icon click (or pressing enter after typing it in, or simlpy press F5 while using YT) a new tab appears, and closes itself instantly.

Is "6bf24443-dfef-4603-bf89-6443c7e..." the new tab in question? If so, is it an extension, and if so what extension is it (about:debugging > This Firefox, you can use Ctrl+F to search for this UUID)?

[ano3213]

Starting today youtube.com (sidebar?) shows up after I go to youtube and then continues to show up on every page until I close and re-open firefox. Unlike the OP though I dont see a new tab opening, it just shows up in the noscript menu.

It even seems to show up on on privledged pages like you can see here.


My noscript version is 13.0.6 and says it was last updated may 19 2025

Also when googling around for the problem I found this thread
https://github.com/hackademix/noscript/issues/429
the last post seems to have the same problem and when I go to www.computerbase.de it also shows up as (sidebar?) and then shows up on every other page that is opened. Strangly when that shows up the youtube.com (sidebar?) disappears and stops showing up on every page. Then If I go back to youtube then the computerbase stops showing up and youtube starts again.

I just noticed that a new tab IS being created every time I go to youtube, its just closing instantly so I never noticed. I just found it by checking recently closed tabs. The Tab that opens is moz-extension://xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/manifest.json which checking debugging is indeed my noscript extension. I suppose ill post the contents of the tab that opens if it helps, if its too long ill delete it.

Code: Select all

{
  "manifest_version": 2,
  "default_locale": "en",
  "name": "NoScript",
  "browser_specific_settings": {
    "gecko": {
      "id": "{73a6fe31-595d-460b-a920-fcc0f8843232}",
      "strict_min_version": "115.0"
    },
    "gecko_android": {}
  },
  "version": "13.0.6",
  "description": "__MSG_Description__",
  "incognito": "spanning",
  "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'none'",
  "icons": {
    "48": "img/icon48.png",
    "96": "img/icon96.png",
    "256": "img/icon256.png"
  },
  "permissions": [
    "contextMenus",
    "storage",
    "tabs",
    "unlimitedStorage",
    "scripting",
    "webNavigation",
    "webRequest",
    "webRequestBlocking",
    "webRequestFilterResponse",
    "webRequestFilterResponse.serviceWorkerScript",
    "dns",
    "<all_urls>"
  ],
  "background": {
    "scripts": [
      "/nscl/lib/browser-polyfill.js",
      "/nscl/lib/punycode.js",
      "/nscl/service/Wakening.js",
      "/nscl/common/sha256.js",
      "/nscl/common/UA.js",
      "/nscl/common/uuid.js",
      "/nscl/common/SyncMessage.js",
      "/nscl/common/log.js",
      "/nscl/common/tld.js",
      "/nscl/common/Messages.js",
      "/nscl/common/CSP.js",
      "/nscl/common/NetCSP.js",
      "/nscl/common/CapsCSP.js",
      "/nscl/common/RequestKey.js",
      "/nscl/common/Sites.js",
      "/nscl/common/Permissions.js",
      "/nscl/common/Policy.js",
      "/nscl/common/locale.js",
      "/nscl/common/Storage.js",
      "/nscl/common/include.js",
      "/nscl/common/DNS.js",
      "/nscl/common/AddressMatcherWithDNS.js",
      "/nscl/common/iputil.js",
      "/nscl/common/SessionCache.js",
      "/nscl/service/Scripting.js",
      "/nscl/service/DocStartInjection.js",
      "/nscl/service/LastListener.js",
      "/nscl/service/patchWorkers.js",
      "/nscl/service/TabCache.js",
      "/nscl/service/TabTies.js",
      "ui/Prompts.js",
      "xss/XSS.js",
      "bg/ReportingCSP.js",
      "bg/Defaults.js",
      "bg/TabGuard.js",
      "bg/RequestGuard.js",
      "bg/Settings.js",
      "bg/popupHandler.js",
      "bg/main.js",
      "common/themes.js"
    ],
    "persistent": false
  },
  "content_scripts": [
    {
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "match_about_blank": true,
      "all_frames": true,
      "js": [
        "/nscl/lib/browser-polyfill.js",
        "/nscl/common/UA.js",
        "/nscl/common/uuid.js",
        "/nscl/common/log.js",
        "/nscl/common/SyncMessage.js",
        "/nscl/common/Messages.js",
        "/nscl/common/CSP.js",
        "/nscl/common/CapsCSP.js",
        "/nscl/common/RequestKey.js",
        "/nscl/content/DocRewriter.js",
        "/nscl/content/Worlds.js",
        "/nscl/main/Worlds.main.js",
        "/nscl/content/patchWorkers.js",
        "/nscl/main/patchWorkers.main.js",
        "/nscl/content/DocumentCSP.js",
        "/nscl/content/NoscriptElements.js",
        "/nscl/content/prefetchCSSResources.js",
        "/nscl/main/prefetchCSSResources.main.js",
        "/nscl/content/PlaceHolder.js",
        "/nscl/content/sanitizePaste.js",
        "content/onScriptDisabled.js",
        "content/staticNS.js",
        "/nscl/content/media.js",
        "/nscl/content/WebGLHook.js",
        "/nscl/main/WebGLHook.main.js",
        "content/embeddingDocument.js",
        "content/content.js",
        "content/dirindex.js",
        "/nscl/content/DocumentFreezer.js",
        "content/eventsHook.js",
        "content/eventsHook.main.js",
        "content/syncFetchPolicy.js"
      ]
    }
  ],
  "options_ui": {
    "page": "ui/options.html",
    "open_in_tab": true
  },
  "browser_action": {
    "default_area": "navbar",
    "default_title": "NoScript",
    "default_icon": {
      "64": "img/ui-maybe64.png"
    }
  },
  "commands": {
    "toggleEnforcementForTab": {
      "description": "__MSG_toggleEnforcementForTab__",
      "suggested_key": {
        "default": "Alt+Shift+Space",
        "windows": "Alt+Shift+Comma"
      }
    },
    "openPageUI": {
      "description": "__MSG_pagePermissionsUI__",
      "suggested_key": {
        "default": "Alt+Shift+N"
      }
    },
    "tempTrustPage": {
      "description": "__MSG_TempTrustPage__"
    },
    "revokeTemp": {
      "description": "__MSG_RevokeTemp__"
    },
    "_execute_action": {},
    "_execute_browser_action": {}
  }
}

[barbaz]

I can reproduce this on computerbase.de if I set computerbase.de to (Temp.) TRUSTED and then reload the page.

Is there any possibility this is related to when a site registers a ServiceWorker?

[nn23]

noscript Version: 13.0.6

Does "Disable restrictions for this tab" have any effect on this issue?: No. Only disable scripts globally, or disable in FF settings.

Is "6bf24443-dfef-4603-bf89-6443c7e..." the new tab in question?: Yes

If so, is it an extension, and if so what extension is it (about:debugging > This Firefox, you can use Ctrl+F to search for this UUID)?: No match found.
Also searched the Windows registry, nothing.


Thank you for your time and sry again for double thread.

[Giorgio Maone]

Is there any possibility this is related to when a site registers a ServiceWorker?

Good call.

It's tracked as issue #444, and should be fixed in 13.0.6.902.

[Mad_Man_Moon]

Nice!

I had also noticed this occurring on other domains, too. So, I've seen it occur for SharePoint.

What's more, it might potentially break the Multi-Account Containers section too, because both the YT and SP incidents occurred in separate Multi-Account Containers. So it might be worthwhile raising wherever one raises these types of things.

Sorry about the subject change in my post, but the current one did not make it past the censor.

[MaxH42]

I am seeing something similar, but my tab is not manifest.json but instead moz-extension://[hexcode]/nscl/service/SidebarUtil.tab.js . It concerned me because I kept seeing a new tab pop open and then immediately close, too quickly for me to get any information. I was able to find the tab thanks to this thread, and when I open it manually the browser window says:

// SidebarUtil.tab.js

// This is just a placeholder file to be loaded in a temporary tab to check if a sidebar is open and how wide it is.

Now that I know it's NoScript, I'm not concerned, but thought I'd add the info to this thread.