1876595 - Date picker is Able to Overlap Fullscreen Notification

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Shaheen Fazim]

Attachment: poc.html

By utilizing the Date picker, Firefox fullscreen notifications can be obscured. Below is a proof of concept where the attacker site requests the user to click to launching the Date picker above the fullscreen notification and thereby spoofing the browser.

Steps to Reproduce:

1. Download the poc.html file.
2. Open the poc.html file in firefox for testing.

Comment 1

[Shaheen Fazim]

Attachment: demo.mp4

Comment 2

[Daniel Veditz [:dveditz]]

It's not great that we let things float on top of that banner generally, but this widget doesn't obscure what is happening

Comment 3

[Shaheen Fazim]

Covers the part of the text fullscreen neatly. If possible to launch 2 similar widgets together, could completely cover the banner, but I am not sure if it's possible.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:edgar, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[Edgar Chen [:edgar]]

I think this case could be fixed after bug 1877969.
(Set severity to S2 as bug 1877969 is S2)

Comment 6

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Moving to S3 per the security rating for this particular case. We will revisit and verify this after the S2 bug 1877969.

Comment 7

[Shaheen Fazim]

Hi Dan,

It seems this issue is fixed by Bug 1903187 (just saw it in the advisory). I don't mind duplicating it into that issue, but I would like to know if this qualifies for a bounty and if we can also classify it as sec-medium since the similar bug is also sec-medium.

Comment 8

[Shaheen Fazim]

(Canceling previous comment. Not the same issue. It seems this issue is fixed.)

Hi Hasin-Yi,

Can you verify if this issue is fixed? Thank you.

Comment 9

[Shaheen Fazim]

Attachment: test-1876595.mp4

Tested on the latest nightly version 131.0a1 (2024-08-06) (64-bit) on Windows 11.

Comment 10

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to Shaheen Fazim from comment #9)

Created attachment 9418113 [details]
test-1876595.mp4

Tested on the latest nightly version 131.0a1 (2024-08-06) (64-bit) on Windows 11.

I verify that I saw the same behavior on my Windows 11 machine, when using Nightly 131. The issue is fixed. Thank you.