1877820 - Changing screen.orientation hides Full Screen Notification in Firefox Android

Status: RESOLVED FIXED

(Firefox for Android :: General, defect, P2)

Description

[Umar Farooq [:Puf]]

Attachment: PufIndex.html

Hide Full Screen Notification in Firefox Android Using mailto:
Using Android Intent Link, We Can Hide Full Screen Notification in Firefox Android  
The Intent App Selection Open With & Then it Moves to Full Screen Mode & Turns to landscape screen.orientation

POC Video Private Unlisted : https://www.youtube.com/shorts/mXopnhbh9Q8

Firefox Version: [124.0a1 (Build #2016000647)]
Operating System: [Android 13]

Steps to Reproduce:

1. Host PufIndex.Html In HTTP Server
2. Now Visit the Page Click On [Click Me] Button
3. Open in another app = Now Click On [OPEN]
   4.Success

I Have Attached POC Video Please Check It Out
Please Let Me Know If You Have Any Questions
Thank You

Comment 1

[Umar Farooq [:Puf]]

First It Will Open Apps Selection Dialog, After it will Immediately Enter into FullScreen Mode and then it Turns to landscape screen.orientation
The Fullscreen Notification Hides Behind Apps Selection Dialog. screen.orientation Change landscape to portrait Immediately This Makes User to Delay in Choosing Selection App

Comment 2

[Umar Farooq [:Puf]]

I Would Like to Clarify Here
Full Screen Notification Hides Behind OPEN WITH Apps Selection Dialog
Changing screen.orientation Does not Hide Full Screen Notification
Thank You

Comment 3

[Umar Farooq [:Puf]]

Attachment: PufIndex.html

Full Screen Notification Hides Behind System App Intent Selection Dialog

New POC Video Private Unlisted: https://www.youtube.com/shorts/fNaWroL4mB0
Steps to Reproduce:

0. Open PufNew.html
1. Double Tap Me > On Button
2. Image Selection Dialog Shows It Hides Fullscreen Notification
3. Done

Comment 4

[Umar Farooq [:Puf]]

Attachment: Puf Explain.png

Comment 5

[Umar Farooq [:Puf]]

Two Types of Attacking Techniques in this Vulnerability

1. Double tap on Screen can potentially hide the full-screen toast Using file Select Dialog in Android Which Leads Spoofing

2. in Another Way Attacker Can Use this vulnerability for Stealing Images by Changing Background to http://www.google.com Page Screenshot While It's on Fullscreen Mode & it Does not Show full-screen toast, User thinks it's On Real page http://www.google.com Which Leads to Upload Images

I think severity should be Sec-High Please Verify Once again. Thank you!

Comment 6

[Umar Farooq [:Puf]]

Hello, hope you are doing good.
would you kindly give me an update Regarding severity?
Thank you!

Comment 7

[Umar Farooq [:Puf]]

Hello, any updates here?

Comment 8

[Umar Farooq [:Puf]]

Looks like this vulnerability is fixed! in latest Firefox nightly version
Please Verify and mark Status as fixed

Thank you!

Comment 9

[Umar Farooq [:Puf]]

Verified Testing! Looks like this vulnerability is fixed! in latest Firefox nightly version
Please Verify and Change Status to fixed

Thank you!

Comment 10

[Polly [:polly]]

yes, i agree - have retested in latest nightly (130.0.a1) and looks like this is now fixed! thanks for the heads up :)

Comment 11

[Daniel Veditz [:dveditz]]

This bug will be referenced in the advisory for the fix (bug 1902996)