1437219 - Addressbar spoofing attack with using fullscreen (popup show up over fullscreen mode and hide the fullscreen notification)

Status: RESOLVED DUPLICATE of bug 1432856

(Firefox :: Address Bar, defect, P5)

Description

[Khalil Zhani]

Attachment: Screen Shot 2018-02-09 at 23.55.05.png

this seems like this is a fullscreen bug, Firefox should not allow to show a popup over fullscreen, but Chrome doesn't allow (fixed in https://bugs.chromium.org/p/chromium/issues/detail?id=752003).

Steps to repro:

1. Lunch the test case
2. Click on 'Reload' button
3. Observe

Comment 1

[Khalil Zhani]

Attachment: PoC.rar

Comment 2

[Daniel Veditz [:dveditz]]

Pretty sure I've seen this trick. Need to look for "[e-mail]" or http://www.math1as.com/spoofing_poc.html
 to see if we have a dupe.

Comment 3

[Khalil Zhani]

Is this a dupe bug?

Comment 4

[Daniel Veditz [:dveditz]]

The bug I was thinking of attempted the same thing (cover the fullscreen announcement) but using a different trick. At least, judging by your picture: I couldn't open the archive. If your PoC is multiple files please attach as a .zip or .tar.gz (that order of preference, with .zip highly preferred) and if it's a single file just attach it.

Comment 5

[Khalil Zhani]

Attachment: testcase.zip

Comment 6

[Khalil Zhani]

shouldn't be higher than "sec-low"?

Comment 7

[Xidorn Quan [:xidorn] UTC+10]

The poc doesn't quite work with the default fullscreen transition, but we don't do fullscreen transition on Linux (due to complexity of interaction with arbitrary window manager) and Windows without composition enabled (because you cannot animating the window opacity in that case).

Despite that, I actually constructed a PoC which kinda works even with fullscreen transition, although the transition itself should put good warning that something may be happening.

Anyway, this is probably a duplicate of bug 1432856, and I have a proposed solution there. Just need some time to implement...