1665334 - (CVE-2025-10534) MacOS WebRTC status bar menu site label can be abused for spoofing

Status: RESOLVED FIXED

(Firefox :: Site Permissions, defect, P3)

Description

[Emma Zühlcke [:emz]]

Attachment: url-spoof-webrtc-menu.png

When a webRTC device is shared on macOS we show an indicator in the status bar. When the user clicks the icon we show a list of websites which use the device.
For example: "Sharing Microphone with "permission.site"".

Since we get this label from the website title (and only fallback to site URI), a website can set an arbitrary string, allowing for URL spoofing.

We set the label here:
https://searchfox.org/mozilla-central/rev/30e70f2fe80c97bfbfcd975e68538cefd7f58b2a/browser/modules/webrtcUI.jsm#1002

Here is the full string:
https://searchfox.org/mozilla-central/rev/30e70f2fe80c97bfbfcd975e68538cefd7f58b2a/browser/locales/en-US/chrome/browser/webrtcIndicator.properties#25-31

Comment 1

[Daniel Veditz [:dveditz]]

From the title? That's a pretty bad idea for the last 20 years...

But the permission granting dialog is still correct -- this is just after the fact. I guess title in case people have lots of tabs and can't find the right one? Still isn't the best idea and users should find the microphone icon on the tab itself too, right?

Comment 2

[Emma Zühlcke [:emz]]

Yes, unless they share webRTC devices with multiple tabs with misleading titles it shouldn't be too hard to find the right one. Also, clicking on the menu items in the status bar will switch to the relevant tab and open the identity panel.

We can probably switch to showing a host port combination like the permission prompts do:
https://searchfox.org/mozilla-central/rev/5efefd3ef214ed6d3234ba245c1da3004ead94e0/browser/modules/PermissionUI.jsm#251

This will become more relevant now that Bug 1663784 is bringing the indicator + menu to Windows (and soon also Linux).

Comment 3

[Emma Zühlcke [:emz]]

We no longer show this UI for macOS.

Comment 4

[Mike Conley (:mconley) (:⚙️)]

Hey emz,

Are we sure this is RESOLVED INVALID? I still see the statusbar menu item on macOS (Sonoma), and can still reproduce the title issue. Also it looks like bug 1878147 means that we're not hiding the statusbar menu on modern versions of macOS.

Comment 5

[Emma Zühlcke [:emz]]

Oh, I tested it wrong. I see the status bar now. Thanks for catching this!

Comment 6

[Emma Zühlcke [:emz]]

Attachment: (secure)

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/3bf606026c5f
https://hg.mozilla.org/integration/autoland/rev/df97fb3dbe13
r=mconley,fluent-reviewers,bolsson

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/df97fb3dbe13

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:emz, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox142 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[Emma Zühlcke [:emz]]

The spoofing risk is relatively low so I'd rather just have this ride the train. Let me know if you think otherwise.