1850790 - Full screen notification bypass with window.print() in Firefox for Android

Status: RESOLVED DUPLICATE of bug 1839074

(Firefox for Android :: General, defect, P3)

Description

[Muneaki Nishimura]

Attachment: fenix_fullscreen_bypass_with_print.gif

The advisory for CVE-2022-45404 indicates that full screen notifications could be bypassed using the window.print().
https://www.mozilla.org/en-US/security/advisories/mfsa2022-47/#CVE-2022-45404
This behavior still seems to reproduce in Fenix.

The following URL is the reproduction case.
https://csrf.jp/2023/fenix_fullscreen_bypass_with_print.php
When you click the button on the page, print dialog is shown. And shortly after that, an iframe (1x1 pixel) on the page is displayed in full screen mode.

In Firefox for PC, the processing of window.print() is synchronous, and the iframe will go into full-screen mode after the print dialog is closed.
On the other hand, in Firefox for Android, processing of window.print() is asynchronous, so the iframe shifts to full-screen mode behind the print dialog that covers the entire screen. Then, a Toast is shown on the screen that indicates that the page is switched to full-screen mode, but since the Toast is shown above the print dialog, the user cannot recognize that the iframe on the page behind the Toast is now in full-screen mode.

This is not reproduced in the Android version of Chrome. When the print dialog is present, switching to full screen mode in the background seems to be blocked.

Comment 1

[Daniel Veditz [:dveditz]]

But it does show the toast, as seen in your movie (albeit we already know it's not all that visible on such a large screen). Hardly anything can be trusted after that point unless you know for sure you've exited fullscreen--which sadly is never all that clear either.

Comment 2

[Muneaki Nishimura]

Thank you for your analysis. I think the important thing here is the definition of what Firefox browser gives the user as a trust factor. One way of this might be, as Fenix currently behaves, show a Toast for indicating full-screen mode is enabled at least. On the other hand, Firefox for PC shows the full-screen notification again each time a full-screen tab is active on the screen. It seems a better approach because it can clearly indicate the relationship between active tabs and notifications.

Comment 3

[[:skhan]]

Hi, can this be retested? It might have been fixed by one of the other fixes.

Comment 4

[Muneaki Nishimura]

Thanks! I've verified that this bug has been fixed. Previously, a full-screen popup was displayed on the top of a print screen, which caused misunderstanding as if the print screen was full-screen. But now, the popup is displayed after the print screen is closed, so that the page behind it is displayed as full-screen mode.

Comment 5

[Daniel Veditz [:dveditz]]

This does not appear fixed to me.

1. If I immediately back out of the print dialog then I will see the fullscreen toast on the spoof page as described in comment 4. If instead I stare at the screen a bit wondering "what the heck happened?" before I cancel the print dialog--maybe scroll up and down a bit, a few seconds--then when I exit I go back to the fullscreen spoof page WITHOUT seeing any fullscreen toast/warning
2. In any case, when you exit the print screen dialog you should NOT be in fullscreen mode. You should be in normal mode, as you are in Firefox on Desktop or Chrome on Android. Depending on the order, opening the print screen should either prevent fullscreen or kick you out of fullscreen