1821906 - Geolocation permission hide notification fullscreen

Status: RESOLVED FIXED

(Fenix :: General, defect)

Description

[Hafiizh]

Attachment: video_2023-03-12_20-21-24.mp4

I found a vulnerability in firefox nightly (i tested on Samsung M31 ) where a geolocation permission alert notification can cover fullscreen notifications which can lead to spoofs.

step to reproduces:

1. https://pipabajabakrie.com/upload/geofullscreen.html
2. click on button "Try it"

Comment 1

[Hafiizh]

new POC:

1. open https://pipabajabakrie.com/upload/geofullscreen2.html
2. click on button "Open GOOGLE"

Comment 2

[Hafiizh]

Attachment: video_2023-03-12_20-21-24.mp4

Comment 3

[Hafiizh]

Attachment: geofullscreen2.html

Comment 4

[Hafiizh]

Attachment: google.jpg

Comment 5

[Hafiizh]

Attachment: video_2023-03-13_08-31-16.mp4

Comment 6

[Petru-Mugurel Lingurar [:petru]]

Thank you!
Important to note that this only affects the scenarios in which the toolbar is placed at the bottom (default).
Would be fixed with the same approach as on bug 1816059.

Comment 7

[Petru-Mugurel Lingurar [:petru]]

@Hafiizh Can you confirm that the current Nightly avoids this issue?

Comment 8

[Hafiizh]

Petru its fixed

Comment 9

[Hafiizh]

Attachment: Screenshot_20230317-225623_Firefox Nightly.jpg

Comment 10

[Petru-Mugurel Lingurar [:petru]]

Thank you for the confirmation!

Comment 11

[Daniel Veditz [:dveditz]]

As we expected, this did turn out to be fixed by the redesigned mechanism in bug 1816059 making this essentially a dupe for purposes of the bug bounty.

Comment 12

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: advisory.txt