1854417 - Android Firefox Focus persists Full Screen Mode even after user leave the browser for other apps and come back later

Status: RESOLVED DUPLICATE of bug 1892407

(Focus :: General, defect, P2)

Description

[James Lee]

Android Firefox Focus doesn't exit from the Full Screen mode after user leave the browser for other activity unlike Android Firefox.

Comment 2

[Daniel Veditz [:dveditz]]

James doesn't describe why that would be a vulnerability, but one abuse that comes to my mind would

1. a malicious page shows innocuous content that a user might reasonably make full-screen (for example, a funny video in a small box)
2. wait for a blur event signalling loss of focus, or more likely cause it by calling an intent
3. immediately re-paint the screen to look like the regular Focus UI when not in full screen (browser-in-browser attack)

• copious amounts of social engineering

Comment 3

[James Lee]

Thanks for the explanation, I was thinking to comeback to this report later for additional impact since during the test, permanent full screen spoof was possible and I was going to test that behavior in the near future and add it on here.

Comment 4

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jonalmeida, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[James Lee]

Attachment: fullscreen.html

Comment 6

[James Lee]

Attachment: 1854417.mp4

Comment 7

[Polly [:polly]]

looks like this was fixed by the change made for 1892407