1865413 - (Android) web authn permissions dialog obscured fullscreen notification lead to spoof

Status: RESOLVED FIXED

(Firefox for Android :: WebAuthn, defect, P2)

Description

[Hafiizh]

Attachment: video6251488954193808197.mp4

After fixing it at 1823316, I found that there was another permission dialog that blocked fullscreen notifications, namely the webauthn permission.

step to reproduces:

1. open https://coral-shadowed-parrot.glitch.me/spoof.html
2. click website

mozilla version: nightly 121.0a1
OS version: android 12
​

Comment 1

[Hafiizh]

i updated the poc

step to reproduces:

1. open https://coral-shadowed-parrot.glitch.me/spoof.html
2. click on "setup webauthn" button

Comment 2

[Hafiizh]

Attachment: webauthn.html

Comment 3

[Hafiizh]

Attachment: 2023_11_18_03_28_38.mp4

Comment 4

[Daniel Veditz [:dveditz]]

Chrome also switches to fullscreen, but it shows their fullscreen warning at the bottom (very easy to miss) after the OS Auth UI goes away. The WebAuthn prompt is an OS prompt, not a Firefox one, but we do know that the promise is pending if that's useful. Or at least GeckoView does! It may not be available to the Fenix front end.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jonalmeida, could you have a look please?

For more information, please visit BugBot documentation.

Comment 7

[Chris Peterson [:cpeterson]]

Titouan's fix for bug 1874795 is expected to also fix this bug. Assigning this bug to Titouan as a reminder to test this bug's STR.

Comment 9

[Chris Peterson [:cpeterson]]

Priority P1 because this bug has been assigned to a squad/group.

Comment 11

[Hafiizh]

Hello any updates?

Comment 12

[Titouan Thibaud [:titouan]]

Polly has been working on a proposal for a way to fix all those issues more reliably. We'll bring more details here as soon as we have some results.

Comment 13

[Daniel Veditz [:dveditz]]

Polly: did your fix for bug 1892296 also fix this one? They look like they're the same bug, although the movie in the newer bug that you fixed was slightly more convincing.

Comment 14

[Polly [:polly]]

Unfortunately i think https://bugzilla.mozilla.org/show_bug.cgi?id=1892296 was only a partial fix. This bug has a subtly different timing sequence which means it is still an issue. (I retested this in ff v128 to check).

Comment 15

[Polly [:polly]]

i've retested this in the nightly (v130.0a1) and it looks like the fix for 1902996 has also resolved this.

Comment 16

[Daniel Veditz [:dveditz]]

This bug will be referenced in the advisory for the fix (bug 1902996)