1842587 - tapjacking to allow permission

Status: RESOLVED FIXED

(Firefox for Android :: General, defect, P3)

Description

[Hafiizh]

Attachment: firefox_tapjacking.mp4

i found tapjacking vulnerability on firefox to allow permission

steps to produce:

1. Open https://pipabajabakrie.com/upload/firefox.html or firefox_tapjacking.html
   (if you cannot access https://pipabajabakrie.com/upload/firefox.html you can run your own webserver(it must using domain name) (copy
   filefox_tapjacking.html)
2. tap on "click here button"
3. double tap on "Ok" button

Comment 1

[Hafiizh]

Attachment: firefox_tapjacking.html

Comment 2

[Hafiizh]

its affected on firefox android version 115.0.1

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jonalmeida, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[Hafiizh]

Attachment: 2024_06_27_03_56_11.mp4

after fixing at 1836786 I can still reproduce this bug and it seems the fix is ​​indeed different from 1836786

Comment 6

[Hafiizh]

On 1836786 it was fixed with a delay in the permission dialog whereas in this bug there was no delay because it was probably blocked by the window prompt

Comment 7

[Daniel Veditz [:dveditz] back January 5, 2026]

I can't reproduce anything like either of your two movies (before and after the fix in bug 1836786) -- for me the permission prompt is shown before and on top of the prompt. In the code it looks like the timeouts are about 100ms, and that's way shorter than the time it takes for me to get my fingers from the button at the top of the screen to the buttons at the bottom.

Comment 8

[Hafiizh]

Hi Daniel I can still reproduce it in the latest version of Nightly. If the permission prompt is above the window prompt you can refresh the page and start again

Comment 9

[Hafiizh]

Attachment: 2024_07_03_16_05_50.mp4

Comment 10

[Daniel Veditz [:dveditz] back January 5, 2026]

It mostly didn't work for me because the permission prompt shows up on top, but I did eventually reproduce it twice out of 15-20 attempts.

"double-click on the OK button" is a weird thing to ask people to do so I'm dubious this is an effective spoof, but clearly our delay doesn't take into account the fact that the prompt doesn't have focus and is obscured by another prompt.

Comment 11

[Simon Friedberger [:simonf]]

In the current Nightly 130.0a1 this is not spoofing anymore because the prompt is not shown.

Comment 12

[Daniel Veditz [:dveditz] back January 5, 2026]

fixed, possibly by bug 1908344

Comment 13

[Simon Friedberger [:simonf]]

Arturo, could you confirm?

Comment 14

[Arturo Mejia [:amejia]]

Confirmed, it's the same issue we addressed on bug 1908344