1872664 - Android Firefox Focus Permanent Full Screen Spoof when it's reloaded after opening Nightly and come back

Status: RESOLVED DUPLICATE of bug 1892407

(Focus :: General, defect, P2)

Description

[James Lee]

This is a relatively harder issue to explain, please understand that part first (we might need some lengthy discussion before reproducing and completely understand)

We are able to Full Screen Spoof Android Firefox Focus permanently even when you try to exit.

This happens when we load JavaScript dialog with 401 Auth prompt with full screen and then go to Nightly to trigger reloading behaviour on Focus that will lead to not exitable permanent spoof which is bad.

Please note that I initially found this issue on 118. (I really have to stop excusing myself from reporting bugs immediately that's a bit hard to explain, I know. I'm trying to overcome this and it's one of the main goals this year)

PoC demo: https://pwning.click/focusnoti.php

Comment 1

[James Lee]

Attachment: Screen_Recording_20231016_113222_Firefox Focus.mp4

Comment 2

[James Lee]

Attachment: Screen_Recording_20240102_202854_Firefox Focus.mp4

(Reproduced again today)

Comment 3

[James Lee]

This is what I mentioned on https://bugzilla.mozilla.org/show_bug.cgi?id=1854417#c3

Comment 5

[James Lee]

Ok so we are able to reproduce this with no user interaction just by using other apps for a while and coming back or let device sleep a little and coming back.

Comment 6

[James Lee]

Attachment: Screen_Recording_20240102_224546_Firefox Focus.mp4

Comment 7

[James Lee]

Attachment: Screen_Recording_20240104_000741_Firefox Focus.mp4

We can trigger this without JavaScript dialog and 401 Auth prompt.

Test it on https://pwning.click/focusnoti2.php

Being able to reload JavaScript dialogs with no origin inside full screen spoof when we trigger this seems to be different issue but I'm not sure if I need to open new report for that?

Comment 8

[Daniel Veditz [:dveditz]]

How is this different from bug 1854417? You never provided a testcase for that one, and without that this looks like a demonstration of that concept rather than a different issue.

Comment 9

[James Lee]

bug 1854417 is about Full Screen persisting after leaving focus while this is about "not exitable" with back button Full Screen spoof.

So PoC code would be same simple Full Screen trigger but reproduce steps is different since this is about Full Screen spoof getting stuck so we can't escape from it.

Comment 10

[James Lee]

I just found the report on issue for Firefox which is same impact to this one: https://bugzilla.mozilla.org/show_bug.cgi?id=1719088

Comment 11

[James Lee]

This is P1 sec-high as per https://bugzilla.mozilla.org/show_bug.cgi?id=1719088

Comment 12

[James Lee]

I'll clarify this again, repeatedly clicking / tapping on back button will NOT allow you to exit Full Screen, in fact there is no other way to exit from it as far as I can tell from my test.

bug 1854417 is persisting Full Screen after you left the Focus and come back which is immediately exitable after tapping on back button, while this stuck/jail you inside Full Screen Spoof with any spoofed content.

Comment 13

[James Lee]

Ah, needinfo is done by mistake though, I apologise about that.

Comment 14

[James Lee]

Any update here? is this issue understood or is there anything I can help?

Comment 15

[Polly [:polly]]

as i understand it, i think this is a duplicate of an issue i fixed, but if not please explain the steps to reproduce a bit more clearly