1836921 - (CVE-2024-11700) Tapjacking Android dialog to launch intents

Status: RESOLVED FIXED

(Firefox for Android :: Browser Engine, defect, P2)

Description

[Shaheen Fazim]

Attachment: poc.html

Android applications with unpatched vulnerabilities can be launched from a browser using Intents. Firefox confirms with users whether they want to launch an external application before proceeding, providing protection against these vulnerabilities.

In this proof of concept, I will demonstrate a method where an attacker could lure the victim into unknowingly allow an intent through Tapjacking, using an engaging game.

Steps to Reproduce:
1 . Download the file poc.html to a folder
2. Start a Python server on the same folder by running the command python -m http.server 8080.
3. Open the Android Firefox browser and navigate to the server at http://{YOUR-SERVER-IP}:8080/poc.html to Begin testing.

Comment 1

[Shaheen Fazim]

Video Demonstration: https://youtu.be/EEgzG7ZqcYY (YouTube Unlisted)

Comment 2

[Shaheen Fazim]

Similar issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1810705

Comment 3

[Chris Peterson [:cpeterson]]

Shaheen, thanks for the POC. I'll make sure this bug gets triaged.

Comment 4

[Shaheen Fazim]

Friendly ping.

Comment 5

[Chris Peterson [:cpeterson]]

Assigning this bug to Android squad 2.

Comment 6

[:Gela]

Attachment: tapjack-screenrecord.mp4

I'm having a tough time reproducing this on Android. I see the counter (x6, x5, ...) on the browser but nothing happens when I click on the red box on my Pixel.

Comment 7

[Shaheen Fazim]

Attachment: test.html

Comment 8

[Shaheen Fazim]

My original PoC was outdated (I believe the intent I provided no longer works), but I have just attached a new PoC. Please try with this one test.html.

Comment 9

[Shaheen Fazim]

Attachment: poc.html

Comment 10

[Shaheen Fazim]

Attachment: demo.mp4

Comment 11

[Shaheen Fazim]

Hi Gela, I just updated the PoC ( poc.html ). Can you test this again and see if it is working? Thank you.

Comment 12

[:Gela]

Attachment: WIP: Bug 1836921 - Delay launching intent to avoid tapjacking

Comment 13

[:Gela]

Attachment: Bug 1836921 - Delay tap enablement

Comment 14

[:Gela]

Attachment: Bug 1836921 - Delay launching intents

Comment 15

[:Gela]

Attachment: Bug 1836921 - Delay launching intents

Comment 16

[Shaheen Fazim]

Hi, can we get an update on this issue? Thanks.

Comment 17

[Shaheen Fazim]

Hi Gela, could you update on the issue? Thank you.

Comment 18

[:Gela]

Hello, apologies for the delay. I put up a patch for this a while back but there were some feedbacks on it and other high priority items came up but I am picking this back up today. I will post an update here once I make progress.

Comment 19

[Arturo Mejia [:amejia]]

Attachment: Bug 1836921 - Improve dialogs

Comment 20

[Arturo Mejia [:amejia]]

Attachment: Bug 1836921 - Improve dialogs tests

Depends on D226961

Comment 21

[Arturo Mejia [:amejia]]

Comment on attachment 9433431 [details]
Bug 1836921 - Improve dialogs

Security Approval Request

• How easily could an exploit be constructed based on the patch?: It's not that easy.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: beta, and release
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Not likely, we are reassuring a already existing security component for prompts
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 22

[Tom Ritter [:tjr]]

Comment on attachment 9433431 [details]
Bug 1836921 - Improve dialogs

Approved to land and uplift

Comment 23

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/37cac02470a4
Improve dialogs r=android-reviewers,Roger

Comment 24

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing lint failures:
https://hg.mozilla.org/integration/autoland/rev/51801ac1801c88dd43474b014d51a06510a28218

Push with failures
Failure log

Comment 25

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5f943d5e0ab7
Improve dialogs r=android-reviewers,Roger

Comment 26

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/5f943d5e0ab7

Comment 27

[Donal Meehan [:dmeehan]]

Arturo, please add a beta uplift request on this when you have a moment.
I need to uplift it by eod tomorrow to include it in the final Fx133 beta build.

Comment 28

[Arturo Mejia [:amejia]]

So far we only have done devs verification, should we need to wait until QA can validate in nightly before uplifting?

Comment 29

[Donal Meehan [:dmeehan]]

(In reply to Arturo Mejia [:amejia] from comment #28)

So far we only have done devs verification, should we need to wait until QA can validate in nightly before uplifting?

It can still get an uplift request with a risk assessment

Comment 30

[Arturo Mejia [:amejia]]

Sure!
I'll proceed with the uplift!

Comment 31

[Arturo Mejia [:amejia]]

Attachment: Bug 1836921 - Improve dialogs

Original Revision: https://phabricator.services.mozilla.com/D226961

Comment 32

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: User will still experiment the exploit
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: See comment https://bugzilla.mozilla.org/show_bug.cgi?id=1836921#c0
• Risk associated with taking this patch: The risk is low
• Explanation of risk level: We are just preventing the allow button to be clicked to fast
• String changes made/needed: n/a
• Is Android affected?: yes

Comment 33

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/636403c3e821

Comment 34

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 35

[twhite]

Tom, Daniel - based on Arturo's (now left the org) comment:

Waiting until it's safe to disclose https://bugzilla.mozilla.org/show_bug.cgi?id=1836921

do you have any guidance on whether it safe to land https://phabricator.services.mozilla.com/D227275 now?

Comment 36

[Tom Ritter [:tjr]]

Yes, that's fine. I'll inquire as to why bugbot didn't run for the reminder.

Comment 37

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0d4139ade0d6
Improve dialogs tests r=android-reviewers,Roger

Comment 38

[Ryan VanderMeulen (PTO, back 6-April)]

https://hg.mozilla.org/mozilla-central/rev/0d4139ade0d6

Comment 39

[Vasilica Tamas (Android QA) [:vtamas]]

Attachment: RedBox1.mp4

This issue was verified on Firefox for Android Nightly 139 (2025-04-23) and RC 139 using a Samsung S24 Ultra (Android 14). The page turns into about:blank after tapping once on the red box and canceling the "Open in Phone" pop-up.

Shaheen Fazim could you please confirm that this is the expected behaviour?

Comment 40

[Shaheen Fazim]

Expected behaviour is to protect intent prompt from multiple taps. For example, if a user quickly taps multiple times, it should not allow prompt inbetween to be approved.

It seems like in this case, we're not opening the app using tel:. I'm not sure what's causing the later behavior—like the intent prompt closing and an about:blank page opening. That part shouldn't happen, and I’m not sure if it's intentional. Could you check with the appropriate developer to see if that behavior is expected?

Comment 41

[Shaheen Fazim]

about:blank is shown when window.open is used. Switching line 41 code from window.open('tel:1337'); to location.href = 'tel:1337'; fixes it, and I see tapjacking protection active aswell.