1789348 - bypass - toast notification fullscreen not shown lead to spoofing

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Hafiizh]

Attachment: pocnew - Copy.html

hello i found vulnerabilty when

1. open pocnew -Copy.html
2. wait until it appears : "Double Click Here"
3. Do Double Click / multiple click on ""Double Click Here"" until fullscreen. toast notification fullscreen not shown

Comment 1

[Hafiizh]

Attachment: bandicam 2022-09-06 11-52-45-197.mp4

Comment 2

[Hafiizh]

hello i found a vulnerability where i can bypass toast notification full screen lead to spoofing (toas notification full screen not shown)

1 .open pocnew -Copy.html
2. wait until it appears : "Double Click Here"
3. Do Double Click / multiple click on ""Double Click Here"" until fullscreen. toast notification fullscreen not shown

i attached the video poc

Mozilla Firefox version : 104.0.1 (64-bit)

Comment 3

[Andrew McCreight [:mccr8]]

Edgar, could you take a look? Thanks.

Comment 4

[Daniel Veditz [:dveditz] out until Nov 10]

We've seen this bypass the toast on Windows sometimes, and sometimes not (and not on Mac). Plus, it's so busy with the testcase when would you get believable "fake browser" content loaded? Still wrong, if we can fix it.

Comment 5

[Edgar Chen [:edgar]]

I tried on Linux, sometimes the toast shows with massive delay, especially when there are a lot of iframe has been appended, but it still shows eventually. Maybe there are some room to optimize, but the test is so busy, not sure how much we could do.

Comment 6

[Edgar Chen [:edgar]]

I think bug 1795139 would also help this.

Comment 8

[Daniel Veditz [:dveditz] out until Nov 10]

Edgar: We shouldn't make security bugs a duplicate of a more general fix, we should mark them as "depends on" so they get tested as security bugs after the fix, and an advisory issued if appropriate.

Especially true when tracking bug bounty submissions.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Did we want to uplift bug 1795139 to ESR102? It does graft cleanly, but a sec-low rating also doesn't make it super high priority IMO.

Comment 10

[Edgar Chen [:edgar]]

This probably worth to uplift to ESR, though this is a sec-low, but it also help other sec bug in some way, like bug 1794622.

Comment 11

[June Wilde (she/her) [:jewilde]]

Advisory for 102.7 ESR uplift will also go in 1795139 and reuse the advisory Tom R. wrote there