Fire Mode: WebView profile management (#8575)

Task/Issue URL:
https://app.asana.com/1/137249556945/project/1207418217763355/task/1214780084779090?focus=true
### Description

Isolates WebView state between Regular and Fire browser modes via
AndroidX webkit's `MULTI_PROFILE` API. Each newly-created `WebView` is
bound to its mode-specific `androidx.webkit.Profile` so cookies,
LocalStorage, IndexedDB, and other origin-keyed storage are partitioned
per mode. No-op on devices without MultiProfile support.
Pieces introduced:
- **`WebViewModeInitializer`** (`browser-mode-api`) — binds a
freshly-created `WebView` to the profile for a given `BrowserMode`.
`BrowserTabFragment` injects it and calls `bind(it, browserMode)` inside
`configureWebView()` immediately after inflating the
`DuckDuckGoWebView`, before any settings or clients are applied.
- **`WebStorageProvider`** (`BrowserModeDataProvider<WebStorage>`) —
resolves the per-mode `WebStorage` via `ProfileStore`, falling back to
the shared default `WebStorage` when MultiProfile is unavailable.
- **`BrowserMode.profileName`** extension — stable mapping from mode to
profile name (`REGULAR` → default profile, `FIRE` → `"Fire"`).
- **`FireModeAvailability`** is now synchronous (`fun isAvailable()`),
uses `WebViewFeature.MULTI_PROFILE` directly instead of
`WebViewCapabilityChecker`, warms its cache on main-process `onCreate`
via `MainProcessLifecycleObserver`, and freezes the first computed value
so later flag flips don't change the answer mid-session.
API proposal: [WebViewModeInitializer
interface](https://app.asana.com/1/137249556945/project/1207418217763355/task/1214944190409737?focus=true)
### Steps to test this PR
- [x] Smoke test the app and make sure data-clearing works as before.
There should be no change to any user-visible functionality




<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes WebView creation and session storage partitioning at tab open;
Fire tabs can be closed if profile binding fails, but Regular mode and
devices without MultiProfile should behave as before when binding is
skipped or falls back.
> 
> **Overview**
> Introduces **WebView multi-profile** wiring so Regular and Fire tabs
use separate AndroidX WebView profiles (cookies, LocalStorage,
IndexedDB, etc.), with no binding when `MULTI_PROFILE` is unsupported.
> 
> **`WebViewModeInitializer`** binds each new `WebView` to the profile
for the tab’s `BrowserMode` (via **`BrowserMode.profileName`**) before
any other WebView setup. **`BrowserTabFragment`** calls it right after
inflation; if binding fails in a non-Regular mode, it logs, **closes the
tab**, and tears down the WebView.
> 
> **`WebStorageProvider`** implements
**`BrowserModeDataProvider<WebStorage>`**, returning profile-scoped
storage when Fire/multi-profile is available, otherwise the shared
default.
> 
> **`FireModeAvailability`** is now synchronous, checks
**`WebViewFeature.MULTI_PROFILE`** directly (replacing
**`WebViewCapabilityChecker`**), warms availability on main-process
**`onCreate`**, and **freezes** the first computed result for the
session.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
513ec83. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: 0nko

app/src/main/java/com/duckduckgo/app/browser/BrowserTabFragment.kt

@@ -273,6 +273,7 @@ import com.duckduckgo.browser.ui.browsermenu.BrowserMenuBottomSheet
 import com.duckduckgo.browser.ui.browsermenu.VpnMenuState
 import com.duckduckgo.browser.ui.newtab.hatch.NewTabReturnHatchView
 import com.duckduckgo.browsermode.api.BrowserMode
+import com.duckduckgo.browsermode.api.WebViewModeInitializer
 import com.duckduckgo.common.ui.DuckDuckGoActivity
 import com.duckduckgo.common.ui.DuckDuckGoFragment
 import com.duckduckgo.common.ui.store.BrowserAppTheme
@@ -441,6 +442,9 @@ class BrowserTabFragment :
     @Inject
     lateinit var webChromeClient: BrowserChromeClient
 
+    @Inject
+    lateinit var webViewModeInitializer: WebViewModeInitializer
+
     @Inject
     lateinit var viewModelFactory: FragmentViewModelFactory
 
@@ -3991,6 +3995,19 @@ class BrowserTabFragment :
                 ).findViewById<DuckDuckGoWebView>(R.id.browserWebView)
 
         webView?.let {
+            val bindResult = webViewModeInitializer.bind(it, browserMode)
+            if (bindResult.isFailure) {
+                if (browserMode != BrowserMode.REGULAR) {
+                    bindResult.exceptionOrNull()?.message?.let {
+                            message ->
+                        logcat(ERROR) { message }
+                    }
+                    this.closeCurrentTab()
+                    destroyWebView()
+                    return
+                }
+            }
+
             it.webViewClient = webViewClient
             it.webChromeClient = webChromeClient
             it.clearSslPreferences()

app/src/main/java/com/duckduckgo/app/browser/mode/WebStorageProvider.kt

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2026 DuckDuckGo
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.duckduckgo.app.browser.mode
+
+import android.annotation.SuppressLint
+import android.webkit.WebStorage
+import androidx.annotation.UiThread
+import androidx.webkit.ProfileStore
+import com.duckduckgo.browsermode.api.BrowserMode
+import com.duckduckgo.browsermode.api.BrowserModeDataProvider
+import com.duckduckgo.browsermode.api.FireModeAvailability
+import com.duckduckgo.browsermode.api.profileName
+import com.duckduckgo.di.scopes.AppScope
+import com.squareup.anvil.annotations.ContributesTo
+import dagger.Binds
+import dagger.Module
+import dagger.SingleInstanceIn
+import javax.inject.Inject
+
+/**
+ * Resolves a per-mode [WebStorage]. Callers must invoke [forMode] on the main thread when
+ * `MULTI_PROFILE` is supported on the device — `ProfileStore` is tied to the WebView thread.
+ * Falls back to the default shared [WebStorage] when MultiProfile is unsupported.
+ */
+@SuppressLint("RequiresFeature")
+@SingleInstanceIn(AppScope::class)
+class WebStorageProvider @Inject constructor(
+    private val fireModeAvailability: FireModeAvailability,
+) : BrowserModeDataProvider<WebStorage> {
+
+    @UiThread
+    override fun forMode(mode: BrowserMode): WebStorage {
+        if (!fireModeAvailability.isAvailable()) return WebStorage.getInstance()
+        return ProfileStore.getInstance().getOrCreateProfile(mode.profileName).webStorage
+    }
+}
+
+@ContributesTo(AppScope::class)
+@Module
+abstract class WebStorageProviderModule {
+    @Binds
+    abstract fun bindWebStorageProvider(impl: WebStorageProvider): BrowserModeDataProvider<WebStorage>
+}

app/src/test/java/com/duckduckgo/app/browser/mode/WebStorageProviderTest.kt

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2026 DuckDuckGo
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.duckduckgo.app.browser.mode
+
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.duckduckgo.browsermode.api.BrowserMode
+import com.duckduckgo.browsermode.api.FireModeAvailability
+import org.junit.Assert.assertNotNull
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.mockito.kotlin.mock
+import org.mockito.kotlin.whenever
+
+@RunWith(AndroidJUnit4::class)
+class WebStorageProviderTest {
+
+    private val fireModeAvailability: FireModeAvailability = mock()
+    private val testee = WebStorageProvider(fireModeAvailability)
+
+    @Test
+    fun `forMode returns default WebStorage when multi-profile is unavailable`() {
+        whenever(fireModeAvailability.isAvailable()).thenReturn(false)
+
+        assertNotNull(testee.forMode(BrowserMode.REGULAR))
+        assertNotNull(testee.forMode(BrowserMode.FIRE))
+    }
+}

browser-mode/browser-mode-api/src/main/java/com/duckduckgo/browsermode/api/BrowserModeProfileName.kt

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2026 DuckDuckGo
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.duckduckgo.browsermode.api
+
+import androidx.webkit.Profile
+
+/**
+ * Stable mapping from a [BrowserMode] to its WebView profile name.
+ *
+ * [REGULAR][BrowserMode.REGULAR] shares the default WebView profile;
+ * [FIRE][BrowserMode.FIRE] gets its own isolated profile.
+ */
+val BrowserMode.profileName: String
+    get() = when (this) {
+        BrowserMode.REGULAR -> Profile.DEFAULT_PROFILE_NAME
+        BrowserMode.FIRE -> "Fire"
+    }

browser-mode/browser-mode-api/src/main/java/com/duckduckgo/browsermode/api/FireModeAvailability.kt

@@ -25,5 +25,5 @@ package com.duckduckgo.browsermode.api
  */
 interface FireModeAvailability {
     /** Returns true if the prerequisites are satisfied, false otherwise **/
-    suspend fun isAvailable(): Boolean
+    fun isAvailable(): Boolean
 }

browser-mode/browser-mode-api/src/main/java/com/duckduckgo/browsermode/api/WebViewModeInitializer.kt

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2026 DuckDuckGo
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.duckduckgo.browsermode.api
+
+import android.webkit.WebView
+
+/**
+ * Binds a [WebView] to the WebView profile associated with a [BrowserMode], isolating cookies
+ * and origin-keyed storage (LocalStorage, IndexedDB) between modes.
+ *
+ * Must be called once per [WebView] before any other WebView API call, including `loadUrl`. The
+ * binding is permanent for the lifetime of the [WebView] — it cannot be changed once the
+ * [WebView] has been used.
+ *
+ * Fails on devices that do not support the `MULTI_PROFILE` WebView feature, regardless of the
+ * requested [BrowserMode].
+ */
+interface WebViewModeInitializer {
+
+    /**
+     * Must be called on the main thread.
+     *
+     * @param webView a freshly-created [WebView] that has not yet been used.
+     * @param mode the [BrowserMode] whose profile should back this [WebView].
+     * @return [Result.success] when the profile is bound to the [WebView]; [Result.failure] when
+     * the `MULTI_PROFILE` WebView feature is unsupported on this device, or when the underlying
+     * profile binding call throws.
+     */
+    fun bind(webView: WebView, mode: BrowserMode): Result<Unit>
+}

browser-mode/browser-mode-impl/src/main/java/com/duckduckgo/browsermode/impl/RealFireModeAvailability.kt

@@ -16,30 +16,43 @@
 
 package com.duckduckgo.browsermode.impl
 
-import com.duckduckgo.app.browser.api.WebViewCapabilityChecker
-import com.duckduckgo.app.browser.api.WebViewCapabilityChecker.WebViewCapability.MultiProfile
+import androidx.lifecycle.LifecycleOwner
+import androidx.webkit.WebViewFeature
+import com.duckduckgo.app.di.AppCoroutineScope
+import com.duckduckgo.app.lifecycle.MainProcessLifecycleObserver
 import com.duckduckgo.browsermode.api.FireModeAvailability
 import com.duckduckgo.common.utils.DispatcherProvider
 import com.duckduckgo.di.scopes.AppScope
 import com.squareup.anvil.annotations.ContributesBinding
+import com.squareup.anvil.annotations.ContributesMultibinding
 import dagger.SingleInstanceIn
-import kotlinx.coroutines.withContext
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.launch
 import javax.inject.Inject
 
 @SingleInstanceIn(AppScope::class)
-@ContributesBinding(AppScope::class)
+@ContributesBinding(AppScope::class, boundType = FireModeAvailability::class)
+@ContributesMultibinding(AppScope::class, boundType = MainProcessLifecycleObserver::class)
 class RealFireModeAvailability @Inject constructor(
     private val fireModeFeature: FireModeFeature,
-    private val webViewCapabilityChecker: WebViewCapabilityChecker,
     private val dispatchers: DispatcherProvider,
-) : FireModeAvailability {
+    @param:AppCoroutineScope private val appScope: CoroutineScope,
+) : FireModeAvailability, MainProcessLifecycleObserver {
+
     @Volatile
-    private var multiProfileSupported: Boolean? = null
+    private var cachedAvailability: Boolean? = null
+
+    override fun onCreate(owner: LifecycleOwner) {
+        appScope.launch(dispatchers.io()) { computeAndCache() }
+    }
+
+    override fun isAvailable(): Boolean = cachedAvailability ?: computeAndCache()
 
-    override suspend fun isAvailable(): Boolean = withContext(dispatchers.io()) {
-        if (!fireModeFeature.fireTabs().isEnabled()) return@withContext false
-        multiProfileSupported ?: webViewCapabilityChecker.isSupported(MultiProfile).also {
-            multiProfileSupported = it
-        }
+    private fun computeAndCache(): Boolean {
+        cachedAvailability?.let { return it }
+        val value = WebViewFeature.isFeatureSupported(WebViewFeature.MULTI_PROFILE) &&
+            fireModeFeature.fireTabs().isEnabled()
+        cachedAvailability = value
+        return value
     }
 }

browser-mode/browser-mode-impl/src/main/java/com/duckduckgo/browsermode/impl/RealWebViewModeInitializer.kt

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2026 DuckDuckGo
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.duckduckgo.browsermode.impl
+
+import android.annotation.SuppressLint
+import android.webkit.WebView
+import androidx.webkit.ProfileStore
+import androidx.webkit.WebViewCompat
+import androidx.webkit.WebViewFeature
+import com.duckduckgo.browsermode.api.BrowserMode
+import com.duckduckgo.browsermode.api.WebViewModeInitializer
+import com.duckduckgo.browsermode.api.profileName
+import com.duckduckgo.di.scopes.AppScope
+import com.squareup.anvil.annotations.ContributesBinding
+import dagger.SingleInstanceIn
+import javax.inject.Inject
+
+@SingleInstanceIn(AppScope::class)
+@ContributesBinding(AppScope::class)
+class RealWebViewModeInitializer @Inject constructor(
+    private val webViewProfileBinder: WebViewProfileBinder,
+) : WebViewModeInitializer {
+    override fun bind(webView: WebView, mode: BrowserMode): Result<Unit> {
+        if (!WebViewFeature.isFeatureSupported(WebViewFeature.MULTI_PROFILE)) {
+            return Result.failure(
+                IllegalStateException(
+                    "Attempting to bind a WebView profile to " +
+                        "{${mode.name}} mode when MULTI_PROFILE feature is not available.",
+                ),
+            )
+        }
+        return runCatching {
+            webViewProfileBinder.bind(webView, mode.profileName)
+        }
+    }
+}
+
+interface WebViewProfileBinder {
+    fun bind(webView: WebView, profileName: String)
+}
+
+@ContributesBinding(AppScope::class)
+@SuppressLint("RequiresFeature")
+class AndroidXWebViewProfileBinder @Inject constructor() : WebViewProfileBinder {
+    override fun bind(webView: WebView, profileName: String) {
+        ProfileStore.getInstance().getOrCreateProfile(profileName)
+        WebViewCompat.setProfile(webView, profileName)
+    }
+}