1873367 - The Drive link may obscure the fullscreen notification on the mobile browser.

Status: RESOLVED FIXED

(Firefox for Android :: Browser Engine, defect, P2)

Description

[Rifa'i Rejal Maynando]

Attachment: drive.html

I discovered a vulnerability and tested it on the Firefox Android browser (version 121.0.1, Build #2015995071). The Google Drive link popup can cover the fullscreen notification, potentially leading to user spoofing.

Requirements:

1. Synchronize more than 7-8 Gmail accounts, ensuring that the popup effectively covers the fullscreen notification.
2. Configure the browser to permit the opening of external applications. Access the Advanced Browser Settings, search for the option "open the link in the application" and select the "always" option.

Steps to reproduce:

1. Open the exploit file.
2. Click the button.
3. Observe that the Gmail account popup covers the fullscreen notification.

Comment 1

[Rifa'i Rejal Maynando]

Attachment: drive spoof.mp4

And this is for the video proof of concept (POC)

Comment 2

[Rifa'i Rejal Maynando]

Attachment: on chrome mobile.mp4

After testing on another browser, such as Chrome, the fullscreen mode isn't triggered.

Comment 3

[:Gijs (he/him)]

On desktop we leave fullscreen when the new tab opens.

I'm curious about the Chrome behaviour - from just seeing the screen recording, my guess would be that they consume the transient user gesture activation when the link is clicked to open the tab (in the background, in Chrome, apparently?) and then the request to go fullscreen is denied. But it's hard to be sure this is what's happening without being able to see the developer console for the browser at the same time or something. Edgar, do you know what's supposed to happen here?

Comment 4

[Edgar Chen [:edgar]]

Chrome consumes the user activation when clicking link that would open a new tab or external application, we probably would like to do the same, see bug 1877430.

Comment 5

[Chris Peterson [:cpeterson]]

Titouan's fix for bug 1874795 is expected to also fix this bug. Assigning this bug to Titouan as a reminder to test this bug's STR.

Comment 6

[Chris Peterson [:cpeterson]]

Priority P1 because this bug has been assigned to a squad/group.

Comment 7

[Polly [:polly]]

tested on nightly 130.0a1, not reproducible in this build.
The full screen notification appears on top of the other ui.

Comment 8

[Rifa'i Rejal Maynando]

Is my report eligible for a CVE and a bounty?

Comment 9

[Polly [:polly]]

hi, i don't think i can answer that question, sorry!
But I found this doc which talks about a form you can fill in to request a bounty, if that helps!

Comment 10

[Simon Friedberger [:simonf]]

Could you please explain in more detail how this spoof works. We cannot reproduce this and the video seems to be showing a <select> hiding the notification and nothing related to drive.

Comment 11

[Rifa'i Rejal Maynando]

Attachment: activate open links in apps.jpeg

(In reply to Simon Friedberger (:simonf) from comment #10)

Could you please explain in more detail how this spoof works. We cannot reproduce this and the video seems to be showing a <select> hiding the notification and nothing related to drive.

You should set this to always first, and then reproduce my issue.

Comment 12

[Daniel Veditz [:dveditz]]

(In reply to Rifa'i Rejal Maynando from comment #8)

Is my report eligible for a CVE and a bounty?

This is not eligible for a CVE because it was fixed as part of an implementation change (bug 1902296) that already has an overall CVE. This is just one way to demonstrate the flaw that was fixed, but CVEs are associated with fixes, not PoCs/symptoms.

As a spoof this is only limited because the preconditions are pretty strict. Most users who have only one Google account will never get this picker. If you continue on to the content and then come back to Firefox you appear to be dropped out of fullscreen. The only time I've reproduced the attack was if I clicked "cancel" on the multiple google account picker. But yes, we do think this should get a low bounty.

Comment 13

[Rifa'i Rejal Maynando]

Hello Daniel, how can I claim my bounty?

Comment 14

[Daniel Veditz [:dveditz]]

This bug will be referenced in the advisory for the fix (bug 1902996)

Comment 15

[Daniel Veditz [:dveditz]]

(In reply to Rifa'i Rejal Maynando from comment #13)

Hello Daniel, how can I claim my bounty?

I believe this has been addressed in mail since this request