(In reply to stephen.cunliffe from comment #13) > This issue is a usability issue, and has NOTHING to do with any other domains, or the URL bar. > > This is exclusively to do with the <select> list element within a given web site/app page. The point of comment 12 (and bug 1276976) is that an attacker can abuse a `<select>` element to force its menu-popup to cover up the URL bar and confuse users into thinking they're visiting a different site. For now, our mitigation for that is to constrain <select> popup menus to force them to fit inside the web page's content area. That is indeed a usability tradeoff but it's one that we've decided to make, for the sake of security.
Bug 1936615 Comment 14 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
(In reply to stephen.cunliffe from comment #13) > This issue is a usability issue, and has NOTHING to do with any other domains, or the URL bar. > > This is exclusively to do with the <select> list element within a given web site/app page. The point of comment 12 (and bug 1276976) is that an attacker can abuse a `<select>` element to force its menu-popup to cover up the URL bar and confuse users into thinking they're visiting a different site (which they can then use to try to trick the user into typing in their username/password). For now, our mitigation for that is to constrain <select> popup menus to force them to fit inside the web page's content area, so that it's impossible for them to overlap the location bar. That is indeed a usability tradeoff but it's one that we've decided to make, for the sake of security.