1869607 - HTML Select Option Can Be Used to Spoof Fullscreen

Status: RESOLVED DUPLICATE of bug 1832627

(Core :: DOM: Core & HTML, defect)

Description

[Shaheen Fazim]

Attachment: poc.zip

By utilizing the select options dropdown and consecutively clicking the select tag, Firefox fullscreen notification can be obscured. Below is a proof of concept where the attacker site requests the user to triple-click or double-click with a small delay to launch the select option above fullscreen notification, thereby spoofing the browser.

Steps to Reproduce:

1. Download the poc.html file.
2. Open the poc.html file in firefox for testing.

Comment 1

[Shaheen Fazim]

Attachment: demo.mp4

In the demo, the victim clicked twice; either clicking twice slowly or three times quickly can obscure the fullscreen notification using the select option dropdown.

Comment 2

[Andreas Farre [:farre]]

Hi Makoto! Since you're looking at the related bug 1832627, maybe you could determine if this is an actual duplicat?

Comment 3

[Makoto Kato [:m_kato]]

Yes, this can be dup of bug 1832627. It depends on event order. If fullscreen event is received after showing popup, this issue doesn't occur. After receiving fullscreen event, then when showing popup, popup is override on warning box.

Comment 5

[Shaheen Fazim]

Kindly cc me to that issue, Makoto. Thank you.

Comment 6

[Andrew McCreight [:mccr8]]

I've CCed you to the other bug.

Comment 7

[Shaheen Fazim]

Thank you, Andrew.