1821576 - safety browsing alert notification hides fullscreen notification on firefoxfocus, leads to spoof

Status: RESOLVED FIXED

(Focus :: General, defect)

Description

[Hafiizh]

Attachment: video_2023-03-10_10-13-41.mp4

I found a vulnerability in firefox android where a safety browsing alert notification can cover fullscreen notifications which can lead to spoofs. i tested after fixed: https://github.com/mozilla-mobile/firefox-android/pull/1133 ( https://bugzilla.mozilla.org/show_bug.cgi?id=1819254 )

steps to produce

1, open http://103.186.0.20/focus.html or firefox.html
2. click on "go to google" button , (when the button clicked it show safety browsing alert it covers the fullscreen notification)

OS: Android 10 (Samsung M31)

i attached the poc video files.
thank you

Comment 1

[Hafiizh]

Attachment: focus.html

Comment 2

[Hafiizh]

firefox focus version:
1.0.2310(Build #11)
112.0a1-20230306094520
AS:97.1.0

Comment 3

[Petru-Mugurel Lingurar [:petru]]

Thank you!
Would be fixed with the same approach as on bug 1816059.

Comment 4

[Petru-Mugurel Lingurar [:petru]]

@Hafiizh Can you confirm that the current Nightly avoids this issue?

Comment 5

[Hafiizh]

Petru its fixed

Comment 6

[Hafiizh]

Attachment: Screenshot_20230317-230005_Firefox Nightly.jpg

Comment 7

[Petru-Mugurel Lingurar [:petru]]

Thank you for the confirmation!

Comment 8

[Daniel Veditz [:dveditz]]

As we expected, this did turn out to be fixed by the redesigned mechanism in bug 1816059 making this essentially a dupe for purposes of the bug bounty.

Comment 9

[Hafiizh]

hi daniel your development team decided to use toast or sneakbar 12 days ago (on the same day) on bug https://bugzilla.mozilla.org/show_bug.cgi?id=1816059 (at comment 13 (petru)) while bug this 1821576 opened on the day your Team has not decided to use toast or sneakbar and it has not been fixed and your team opened https://bugzilla.mozilla.org/show_bug.cgi?id=1822140 to decide to use toast instead of sneakbar . I also didn't know you would use toast . didnt you say i redesigned for bug bounty reasons .sigh

Comment 10

[Tom Ritter [:tjr] (OOTO until 9/2)]

Bounty questions should be directed to [e-mail], thanks.

Comment 11

[Tom Ritter [:tjr] (OOTO until 9/2)]

Attachment: advisory.txt