1818679 - (CVE-2025-11716) iframe sandbox on Android allows opening to external protocol (including `intent:`)

Status: RESOLVED FIXED

(GeckoView :: General, defect, P2)

Description

[haxatron1]

iframe sandbox requires one of the following to open external protocol. (ref: https://chromestatus.com/feature/5680742077038592)

• allow-popups
• allow-top-navigation
• allow-top-navigation-with-user-activation
• allow-top-navigation-to-custom-protocols

On Firefox for Android, iframe sandbox requires none. Compare this to Firefox for Desktop where it is correctly blocked.

STR:
Go to external.html and click the link. You will open Phone app.

Expected: Phone app not opened because none of the required attributes are not set.

Comment 1

[haxatron1]

Attachment: external.html

Comment 2

[[:owlish] 🦉 PST]

We need to investigate this and find out why this is different from desktop (something not implemented? a bug?). We already have several bugs that seem to be related to this, and we need to improve our iframe support. Nominating this for the next sprint

Comment 3

[Daniel Veditz [:dveditz]]

This is essentially the same thing as bug 1791312, but since intents and external protocol handlers are different mechanisms internally it's probably safest to track each separately lest one be forgotten.

Comment 4

[haxatron1]

I would say this bug is a dependency of bug 1791312. Reason being that even if intent URLs were to follow the 4 attribute listed, a fallback intent initiates a top-navigation. This effectively means that:

1. Enabling allow-popups implies that a sandboxed iframe can cause a top navigation if they want to which would eliminate the sandbox flags.

2. allow-top-navigation-to-custom-protocol now becomes allow-top-navigation by abusing intent fallbacks.

Comment 5

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:cpeterson, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 6

[Chris Peterson [:cpeterson]]

Irene, this bug's status tracking flags say it's fixed in firefox111 - firefox113, but this bug is still open. Are the status flags incorrect? If so, I can reset them to affected.

Comment 7

[Chris Peterson [:cpeterson]]

Dropping to P2 because Irene says she's not actively working on this bug.

Comment 8

[Daniel Veditz [:dveditz]]

Just to make it clear, intent: is an external protocol. But because android <gestures>, we should explicitly test to make sure it's blocked also once this is fixed.

Comment 9

[[:owlish] 🦉 PST]

Hey Segun, can you schedule this one in? Thanks!

Comment 10

[Segun Famisa [:segun]]

Forwarding the NI to Jeff

Comment 11

[Jeff Boek [:boek]]

Triaged it into our backlog.

Comment 13

[Jeff Boek [:boek]]

Attachment: (secure)

Comment 14

[Nika Layzell [:nika] (ni? for response)]

We discussed this on Slack, where I gave some feedback which led to the patch in comment 13. Clearing ni?

Comment 15

[Jeff Boek [:boek]]

Attachment: (secure)

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/822ad7739fe2
https://hg.mozilla.org/integration/autoland/rev/f6fcd6a4a3be
Decide when to call GeckoView r=necko-reviewers,valentin

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/f6fcd6a4a3be

Comment 18

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/774961481045
https://hg.mozilla.org/integration/autoland/rev/850c36f752ae
Adds tests to confirm onLoadRequest isn't called r=geckoview-reviewers,tcampbell

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5a3c801cd646
https://hg.mozilla.org/integration/autoland/rev/d58ab8cdc03c
Revert "Bug 1818679 - Adds tests to confirm onLoadRequest isn't called r=geckoview-reviewers,tcampbell" for causing lint failures @NavigationDelegateTest.kt.

Comment 20

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing lint failures @NavigationDelegateTest.kt:

• Push with failures
• Failure log

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/9050781f98b3
https://hg.mozilla.org/integration/autoland/rev/55dcb5b5074b
Adds tests to confirm onLoadRequest isn't called r=geckoview-reviewers,tcampbell

Comment 22

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/55dcb5b5074b

Comment 23

[Daniel Veditz [:dveditz]]

Attachment: advisory.txt