1859167 - Tall prompt() dialog can hide the Firefox UI, allowing site spoofing

Status: REOPENED

(Firefox for Android :: Browser Engine, defect, P3)

Description

[James Lee]

We are able to cover browser UI including address bar on Android Firefox with this issue.

PoC:

<iframe src="data:text/html;base64,PHNjcmlwdD5wcm9tcHQoIlxuXG5cblxuXG5cblxuXG5cblxuXG5cblxuXG5cblxuXG5cblxuXG5cblxuXG5cblxuXG5cblxuXG5cblxuIiwgIkUtTWFpbCAvIFBhc3N3b3JkIik7PC9zY3JpcHQ+");>

Comment 1

[Andrew McCreight [:mccr8]]

Bug 1859168 and bug 1859169 are the equivalent bugs for Android Focus and iOS Focus.

Comment 2

[James Lee]

They all have slightly different behaviours, I'll explain them in the near future. Btw, iOS is for Firefox not Focus :)

Comment 3

[:Gijs (he/him)]

(In reply to James Lee from comment #2)

They all have slightly different behaviours, I'll explain them in the near future. Btw, iOS is for Firefox not Focus :)

Is the explanation somewhere else, or is "near future" still in the future? :-)

It's a bit hard to tell from this report what is going on and/or how the three bugs relate, given you claim they have different behaviours.

Comment 4

[James Lee]

This could be more useful when it's used together with other bugs which are on the list of to be reported. Android ff / focus / iOS ff all differs from that perspective. Sorry for late and thanks for summarising this.

Comment 5

[Daniel Veditz [:dveditz]]

Attachment: testcase

Comment 6

[Daniel Veditz [:dveditz]]

POC decoded is

<script>prompt("\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n", "E-Mail / Password");</script>'

It doesn't cover anything on my Samsung Galaxy, but that's pretty tall. If I turn the phone sideways it does cover part of the address bar. But it's obvious that it's covering it, and you can't do anything while the prompt is open. Maybe on a shorter phone it would be more likely to work, or with more newlines. Don't really see how this spoofs anything.

Comment 7

[Daniel Veditz [:dveditz]]

So maybe there's a building block to a spoof here that we're not seeing, but there's clearly no actual spoof yet in this bug

Comment 8

[James Lee]

Attachment: Screenshot_20240526-045638_Firefox Nightly.jpg

This works by just adding more \n which leads to spoof since we are able to hide the origin of dialog the URL bar.

There are still some PoCs and ideas I haven't shared which I'll decide if I'm going to include in this report or add on the other bug report I'll send in.

Comment 9

[:Gijs (he/him)]

(In reply to Daniel Veditz [:dveditz] from comment #6)

But it's obvious that it's covering it, and you can't do anything while the prompt is open.

You can type in the prompt, I think? So the latest screenshot would presumably use this to ask for an email or password without it being obvious to the user what origin was doing the asking.

I'm not convinced this is particularly problematic but I figured we should at least consider the new information rather than leaving this closed, so reopening.

Comment 10

[Daniel Veditz [:dveditz]]

ok