1821155 - keyboard layout hides fullscreen notification on landscape mode on firefoxfocus, leads to spoof

Status: RESOLVED FIXED

(Focus :: General, defect, P2)

Description

[Hafiizh]

Attachment: video_2023-03-09_03-56-27.mp4

I found a vulnerability in firefox focus (landscape mode) when click on the text box it opens keyboard layout when running fullscreen, keyboard layout covers fullscreen notification.

steps to generate

1. Go to http://103.186.0.20/fullscreenfocus.html
2. Click on TextBox (hide full screen notification)

Comment 1

[Hafiizh]

Attachment: firefoxfocus.html

Comment 2

[Hafiizh]

Attachment: googlebar3.jpeg

Comment 3

[Hafiizh]

update step to produces:

1. Go to http://103.186.0.20/fullscreenfocus.html (open on landscape mode)
2. Click on TextBox (hide full screen notification)

Comment 4

[Hafiizh]

I tested on Samsung M31 (Android 10)

Comment 5

[Hafiizh]

Attachment: video_2023-03-11_09-51-21.mp4

Comment 6

[Hafiizh]

i updated the poc please see the new poc video. notification full screen closed by telegram notification (still on landscape mode)

Comment 7

[Hafiizh]

Attachment: nightlypoc.mp4

its also affected on nightly

Comment 8

[Joe M [:jmahon]]

Petru, based on your similar work for bug 1816059, do you know if a Toast would appear over the system keyboard? I'm wondering if we can just use that same fix here in Focus.

Comment 9

[Petru-Mugurel Lingurar [:petru]]

Yes, a Toast does not know what being shown on the screen, it will be shown at a specific location on top of anything that's showing so bug 1816059 would fix this also.

Comment 10

[Petru-Mugurel Lingurar [:petru]]

@Hafiizh Can you confirm that the current Nightly avoids this issue?

Comment 11

[Hafiizh]

Petru its fixed

Comment 12

[Hafiizh]

Attachment: Screenshot_20230317-225230_Firefox Nightly.jpg

Comment 13

[Petru-Mugurel Lingurar [:petru]]

Thank you for the confirmation!

Comment 14

[Chris Peterson [:cpeterson]]

This fix can ride the trains in 112. We don't need to uplift to a 111 dot release if the bug isn't being actively exploited.

Comment 15

[Daniel Veditz [:dveditz]]

As we expected, this did turn out to be fixed by the redesigned mechanism in bug 1816059 making this essentially a dupe for purposes of the bug bounty.

Comment 16

[Hafiizh]

hey daniel your development team decided to use toast or sneakbar 12 days ago on bug https://bugzilla.mozilla.org/show_bug.cgi?id=1816059 (on comment 13 (petru)) while this bug 1821155 opened the day before Your team decided to use a toast or sneakbar and it hasn't been fixed yet and your team went to https://bugzilla.mozilla.org/show_bug.cgi?id=1822140 to decide to use a toast instead of a sneakbar. I also didn't know you would use toast . don't you say I redesigned it for bug bounty reasons .sigh

Comment 17

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 18

[Tom Ritter [:tjr]]

Attachment: advisory.txt