Integration between Linux app and Snap Firefox

Hello everyone, 

If you installed 1Password for Linux or your browser using a containerized package manager such as Snap or Flatpak, the app won’t be able to communicate with the 1Password browser extension. To use 1Password for Linux with the 1Password browser extension, make sure you install both 1Password for Linux and your preferred browser using an installation method other than Snap or Flatpak, such as through your distribution’s built-in package manager. You can find documentation here: 

• If the 1Password browser extension doesn’t unlock when you unlock the 1Password app - If you’re using a Linux computer

We’re aware this limitation isn’t ideal, and a feature request is open explore expanding support for other installation methods in the future. We appreciate everyone's continued feedback!

-Dave

CFP-19395

Do we have any news? I saw that 1Password uses Native Messaging, and now we have a portal for that: https://github.com/flatpak/xdg-native-messaging-proxy. I think one relevant bug is this one: https://bugzilla.mozilla.org/show_bug.cgi?id=2005167 , it's related to Firefox not using a XDG compliant path to the native messaging files.

OS: Ubuntu 24.04

Desktop environment: GNOME on X11

Browser: Firefox 147.0.1 (64-bit)

Output of `snap list firefox`: firefox 147.0.1-1 7672 latest/stable/… mozilla✓   -

1Password desktop app version: 1Password for Linux 8.12.0, 81200013, on PRODUCTION channel

1Password browser extension version: 1Password browser extension version 8.11.27.2, 81127002, on STABLE channel

On my computer, the desktop app "Connect with 1Password in the browser" and browser extension "Integrate this extension with the 1Password desktop app" settings are turned on, but the setting doesn't work. The browser extension settings page says "Integration status: Connection problem":

The contents of the log in `/root/.config/1Password/logs/BrowserSupport/1Password_rCURRENT.log` says:

INFO 2026-01-25T00:41:13.003+00:00 main(ThreadId(1)) [1P:native-messaging/op-browser-support/src/main.rs:392] Starting 1Password-BrowserSupport 8.12.0 production build no. 81200013.
INFO 2026-01-25T00:41:13.012+00:00 tokio-runtime-worker(ThreadId(9)) [1P:native-messaging/op-browser-support/src/main.rs:305] browser message handler started
INFO 2026-01-25T00:41:13.012+00:00 main(ThreadId(1)) [1P:native-messaging/op-browser-support/src/browser_verification/linux.rs:44] Verifying browser "/usr/libexec/xdg-desktop-portal"
ERROR 2026-01-25T00:41:13.073+00:00 main(ThreadId(1)) [1P:native-messaging/op-browser-support/src/main.rs:430] Browser support error: UnknownBrowser(/usr/libexec/xdg-desktop-portal), happened in: native-messaging/op-browser-support/src/browser_verification/linux.rs:103
        Additional error context: /usr/libexec/xdg-desktop-portal isn't a supported browser

The 1Password browser extension communicates with the desktop app through the https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging web API, which launches the `/opt/1Password/1Password-BrowserSupport` program. While https://support.1password.com/kb/202408b/, it does try to check whether the launching process is a legitimate browser https://bucket.agilebits.com/security/SecfaultSecurity_Report_B5x_Security_Assessment_v1.1.pdf. You can add browsers to the list on Linux through https://support.1password.com/additional-browsers/?linux.

https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/+bug/1943840. However, because https://ubuntu.com/blog/a-guide-to-snap-permissions-and-interfaces, https://discourse.ubuntu.com/t/call-for-testing-native-messaging-support-in-the-firefox-snap/29759/105.

Since that update in November 2022, Firefox Snap has used xdg-desktop-portal to make the Native Messaging API work. However, 1Password has not yet added xdg-desktop-portal as a supported caller of the 1Password-BrowserSupport process.

1Password has a strong interest in only allowing legitimate browsers to initiate the NMH by default. It checks the executable name against a specific list and checks that the file & its folder are owned by root. Allowing xdg-desktop-portal would present somewhat of a security risk because various applications can use the portal, but it has its own permissions mechanism that requires the user to allow access to the WebExtension backend (https://discuss.kde.org/t/where-are-the-privacy-settings-firefox-extension-native-messaging/6367):

Would y'all consider adding it? Thank you for your time.

adfhogan That matches up with what is showing in Firefox developer tools for the extension. In the console, it shows:

text
Received <BrowserVerificationFailed> from the native core


(about:debugging in the url bar > This Firefox > Inspect on the 1Password extension)

That suggests the extension and desktop app are communicating, but some security check fails.

When on Ubuntu 22.04, I tried replacing the snap version of Firefox with the apt version as per the support page. I'd already spent a long time confused before eventually figuring out that apt install firefox was just installing the snap instead. When I finally got the apt version installed, my security key wouldn't work with it. Eventually I just gave up and re-installed the snap version, accepting that I'd have to use the extension and desktop app separately. I won't be attempting the apt version again given Ubuntu 24.04 is pushing snap packages even more.

It is annoying to have to log into both the extension and the desktop app separately, especially as the app experience is much better for editing entries.

The impression I've gotten is that 1Password has an internal process for verifying that the calling process (the browser) is authorised and/or can be verified by the 1Password app, such that a malicious program couldn't just drain 1Password's store the moment the user unlocked it... and it's the sandboxing that snaps do that prevents the 1Password app from seeing through to the 1Password browser plugin fully.

There are ways to whitelist snaps to get access to things, but I wonder if the way this can be done, and the way that Ubuntu does the snap perhaps don't play nicely?

Either way, it would be nice for an update from the 1Password devs on this beyond "not yet" :)

I think Gnome Extensions uses Native Messaging to communicate, but I think 1Password doesn't use it, maybe they use an internal solution to do this communication between the app and the browser.

I hesitate to comment, because the answer has just been no for so long. But, I wanted to comment that snap browser integration is now available in Firefox with Gnome Extensions. It asked me for permissions and then just worked.
Likewise, I was asked for permission for 1Password... but nothing happened. The integration did not work. So it seems like the permission framework is there but not fully connected with the 1Password app. Not sure what needs to happen to allow that through, like they did for Gnome Extensions.

There are multiple threads..

• There are still .debs available from other places other than Ubuntu themselves.
• You can remove the snap and their deb that installs the snap, and switch to third party debs (like Mozilla) if you like
• 1Password still doesn't have snap integration, as the way they verify the invoking browser process doesn't support snaps due to the way they sandbox
• If you use the snap version, you can use browser plugin standalone. It won't integrate with local instance of 1Password, but still works.

I am about to/trying to move from Kubuntu 22.04 to 24.04.1 (which came out yesterday).
The release upgrade script is telling me that only Firefox via Snap shall be an option; I am not given a choice to keep the .deb as installation option.
Since the upgrade failed and I had to rollback (thanks snapshots!), I cannot yet check whether I could still manually switch back from the snap to a .deb installation, after the upgrade.
The point being; Ubuntu is pushing snaps more agressively; please explain where we stand regarding the integration between the browser plugin and the local installation.

The harder Ubuntu pushes snap the more annoying it is that this doesn't work well.