1657092 - Location prompt shouldn't overlap with form-autofill for cc and other menus due to z-index difference on nested elements

Status: RESOLVED INVALID

(Toolkit Graveyard :: Notifications and Alerts, enhancement)

Description

[Cristian Fogel [:cfogel]]

Attachment: z-index.png

Affected versions

• 80.0b3, 81.0a1(2020-08-03);

Affected platforms

• Windows 7/10, macOS 10.15.5

Steps to reproduce

• VPN set up for USA;
• extensions.formautofill.available - true;
• extensions.formautofill.available - on;
• browser.search.region - ;US
• at least one entry for user and credit card autofill saved;

1. Launch Firefox and access https://www.bestbuy.com (until step 5 you can grant permission to track location);
2. Add any product and proceed to guest checkout;
3. Fill in address data;
4. Scroll down the page a bit so the credit card input is at the top of the page;
5. Remove the location tracking permission, refresh the browser page;
6. Click on the credit card input field for autofill options;

Expected result

• z-index for input field and child elements should be the same (under the location prompt);

Enhancement suggestion

• the cc-autofill dropdown should not overlap as such the location prompt;

• this might be extended to other dropdowns as well
  OR as per the scenario with password manager saving passwords to have a similar indication that user-action is needed and close this menu if clicking somewhere else in page;

Actual result

• input field is in background, location prompt in middle, cc-autofill in foreground;

Regression range

• most likely not a regression, will check if needed;

Additional notes

• long STR but did not have time to prepare a proper TC for it;
• attached screenshot with the issue;
• suggested severity is S4.

Comment 1

[Matthew N. [:MattN]]

Since you interacted with the form autofill last and both popups are Firefox UI (without arbitrary content), we think that the current behaviour is expected. It would be a problem if an attacker could control the top-most UI and introduce a spoofing or click-jacking issue.