1816289 - Firefox Android Sandbox Escape with intent

Status: RESOLVED DUPLICATE of bug 1810705

(Firefox for Android :: General, defect)

Description

[James Lee]

We are able to escape from Sandbox for most popular android devices via intent.

Latest Firefox on Samsung Galaxy series: <script>location="intent://whatsmyua.info#Intent;scheme=https;package=com.sec.android.app.sbrowser;end"</script>

Latest Firefox on Xiaomi series: <script>location="intent://whatsmyua.info#Intent;scheme=https;package=com.mi.globalbrowser;end"</script>

https://whatsmyua.info will show latest Galaxy's default browser version is 106 and Xiaomi's default browser version is 100 in chrome where countless rce and sbx ndays could be found from chrome commits that allow using of easily writable rce and sbx chain exploits to compromise users' latest devices.

Comment 1

[James Lee]

Tested on latest Firefox on Android. Just for the note, I can share rce+sbx exploits for 100+ and 106+ chain demo to show user privilege compromise is possible.

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

Duplicate bug 1810705?

Comment 3

[Daniel Veditz [:dveditz]]

This sounds like that, yes. James: we've implemented a change in Firefox 110 (out yesterday?) that puts up a prompt before opening things in outside apps. It's a dilemma because there might be old exploitable programs out there (which isn't Firefox's fault) but if we block all intent then we break functionality that users do want.

Obviously a user could say "yes" to the prompt and get hacked nonetheless, but this is maybe a reasonable place to draw the line and at least protect some people after the word gets out that an attack is going on. And also maybe the press attention from such an attack will shift consumers to use phones from companies who have a committment to security fixes.

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

Change is in 111 Beta. It was not uplifted to 110, it required new strings.

Comment 5

[James Lee]

Can we add a security embargo on here and https://bugzilla.mozilla.org/show_bug.cgi?id=1810705 since this and variants work on some other browsers? thanks!