[Security] Disabled block element picker in Private Windows as reported on HackerOne by newfunction. (#43495)

@dazed_and_confused private window creates a new session with no cookies and it defaults to stricter Shields settings. Then when you exit your private session, it clears your history and cookies (which include site specific settings). That’s it.

Your settings are borrowed from your main profile and any settings changes you make persist. In fact, if you go to a private window and try to open your settings you’ll see that it takes you to a normal window and no longer remains in the private theme. There are not two sets of settings, where one is for private.

When you Block Element it would create a listing in your settings, under Content Filtering. Again, this is going to your main settings as there are no “private window” options. In fact, any custom content filter you add will appear in all profiles across your device, as it’s saving to the core of Brave rather than to an individual profile.

People who think 100% of their private window is isolated, having Block Element as an option would be seen as some big violation. As such, it was removed. It’s still not flawless and people gripe, kind of like one of the links that 289wk showed, Custom filters permanently created when in private browsing.

But it’s not like it’s a “security” issue in terms of any dangers. It’s just people being very picky on how things are handled on their data and what types of things persist on their device. Ideally Brave would sanbox things a bit more. Changes to Shields on one profile shouldn’t impact another. And in that same token, changes on a private window shouldn’t necessarily be kept and impact a normal window.