Closed Bug 1884023 Opened 2 years ago Closed 2 years ago

showPicker overrides other browser notifications and blocks key presses.

Categories

(Core :: DOM: Core & HTML, defect)

defect

Tracking

()

RESOLVED DUPLICATE of bug 1875354
129 Branch
Tracking Status
firefox-esr115 --- wontfix
firefox-esr128 - fixed
firefox128 --- wontfix
firefox129 --- fixed

People

(Reporter: Laraweron, Assigned: canadahonk)

References

Details

(Keywords: csectype-spoof, reporter-external, sec-moderate, Whiteboard: [reporter-external] [client-bounty-form] [verif?][adv-main129-])

Attachments

(3 files)

The showPicker function overlaps all browser notifications, including the notification about entering fullscreen mode. If you set the setInterval function to 0ms, the window will not disappear from the screen. Also, we can bypass the restriction on full screen mode for a single click by introducing a delay in the code. After that, we can stop part of the code execution and create the appearance that the user has switched to another site. Somehow, showPicker with setInterval set to 0ms completely blocks key presses, making it impossible to exit the window. The only way to close the window is to press Ctrl+W.

In my example, I didn't create a fake image of the address bar. There's too much front end work, but it's entirely possible.

To reproduce the fake error, run poc.html. Click on the button.

For the other code in esc.html, click anywhere on the screen. To exit, press Ctrl+W; I haven't found another way.

Flags: sec-bounty?
Attached file poc.html
Attached file esc.html
Attached video video.mp4
Group: firefox-core-security → dom-core-security
Component: Security → DOM: Core & HTML
Product: Firefox → Core

I created a test example at: https://notgreendewald.online/not3.html
I think it can be improved.

Bug 1877969 might fix this, needs more investigation once it is pushed.

Severity: -- → S2

We'll have to figure out which of the variants are dupes when we fix it. This looks maybe the same as bug 1875354

See Also: → CVE-2024-7518

Patch D209667 partially fixed the esc key lock, but a bug appeared. After exiting full screen mode, the text will be highlighted. After exiting full screen mode, hover your cursor over the address bar.

Oliver, is it worth filing a bug about comment 7? Thanks.

Flags: needinfo?(omedhurst)
See Also: → 1902131

This seems partially fixed with Bug 1877969 but still behaving weird and worth some effort imo.

Flags: needinfo?(omedhurst)

It seemed to work as expected to me when testing poc.html or https://notgreendewald.online/not3.html.
Is this still reproducible to you, dear reporter?

Flags: needinfo?(Laraweron)

The bug is completely fixed, I don't see any errors

Flags: needinfo?(Laraweron)

Thank you very much for the confirmation.

Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Assignee: nobody → omedhurst
Group: dom-core-security → core-security-release
Target Milestone: --- → 129 Branch
QA Whiteboard: [post-critsmash-triage]
Flags: qe-verify+

As expected these .showPicker() bugs were all the same fundamental flaw.

Duplicate of bug: CVE-2024-7518
Flags: sec-bounty? → sec-bounty-
Resolution: FIXED → DUPLICATE
Whiteboard: [reporter-external] [client-bounty-form] [verif?] → [reporter-external] [client-bounty-form] [verif?][adv-main129+]
Whiteboard: [reporter-external] [client-bounty-form] [verif?][adv-main129+] → [reporter-external] [client-bounty-form] [verif?][adv-main129-]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: