1810358 - Android Mozilla Screenshot Prevention Bug

Status: NEW

(Fenix :: General, defect, P5)

Description

[michaellrowley]

Attachment: Screenshots.zip

The Android Firefox application (version 109) allows users to disable screenshots in private browsing mode - to the best of my knowledge this involves the use of a FLAG_SECURE layout parameter.
In various flows throughout the application, this flag is not set (possibly because it cannot be set); in some of those situations, the information visible on the screen could be sensitive to users.

Recreating this situation is as simple as toggling the screenshot prevention feature (https://support.mozilla.org/en-US/kb/private-browsing-firefox-android#w_allow-screenshot-in-private-browsing) and navigating to the same location as the attached images show. I have included a list of these situations for your convenience here:
· Tap and hold on a link
· Tap and hold on an image
· Type an address in the navigation bar
· Tap the padlock icon next to a domain in the navigation bar
· (After the previous step;) Tap the connection security label in the new dropdown (typically 'Connection is secure')

These bugs may have different remediative steps for each respective flow, ranging from hiding the keyboard when a screenshot is detected to moving sensitive information away from frames/windows that cannot have FLAG_SECURE applied to them.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:cpeterson, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Daniel Veditz [:dveditz]]

This is essentially an "attack" on yourself? Inconsistent with the setting but not something that could be used by a 3rd party attacker against you: doesn't need to be hidden.

Comment 3

[michaellrowley]

Hi :dveditz,

I thought that blocking screenshots in private mode was intended to prevent apps which are locally running on the device (i.e, malware, screen sharing tools) from being able to get any data from the screen which could then be used for malicious purposes?

Apologies for misunderstanding that!

Comment 4

[Brandi Alexander]

Attachment: same problem

Thanks from parmouvanfi1973.