1881902 - Permission Dialog allows to conduct Full Screen Spoof attack without notification on Android Firefox Nightly

Status: RESOLVED DUPLICATE of bug 1871217

(Fenix :: General, defect)

Description

[James Lee]

Attachment: Screen_Recording_20240224_192608_Permission controller.mp4

We can launch Permission Dialog such as camera, as soon as user enter to full screen mode resulting to hiding notification with full spoof.

• Steps to reproduce:

Open https://pwning.click/camfullnoti.php and tap on "CLICK TO PLAY" which will reproduce this bug.

• How to fix this issue

Let's check what Android Chrome does: Android Chrome would immediately exit full screen mode if any permission was requested and this is the ideal behaviour we want to see from Nightly.

Comment 1

[James Lee]

(In reply to James Lee from comment #0)

• How to fix this issue

Let's check what Android Chrome does: Android Chrome would immediately exit full screen mode if any permission was requested and this is the ideal behaviour we want to see from Nightly.

Alternatively, we could show the notification above the permission dialog which is what Android Opera GX is doing.

Comment 2

[James Lee]

Attachment: camloc.html

Here are all needed files if you want to test on your server.

Comment 3

[James Lee]

Attachment: camaccess.html

Comment 4

[James Lee]

Attachment: getcam.js

Comment 5

[James Lee]

Attachment: Screen_Recording_20240225_025400_Permission controller.mp4

Comment 6

[Daniel Veditz [:dveditz]]

This prompt comes from the OS itself and for most permissions is only asked once, ever (unless the user chooses "only this time"). Sadly that means the more cautious/careful users are more at risk from this spoof than most other folks.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:bclark, could you have a look please?

For more information, please visit BugBot documentation.