1886469 - Firefox for Android with the Open Link in Apps feature enabled can lead to spoofing of the address bar.

Status: RESOLVED FIXED

(Firefox for Android :: Browser Engine, defect)

Description

[Raphael]

Attachment: video_2024-03-20_19-57-44.mp4

By default, this feature is disabled for the user, however, if the slider is set to Always mode, it is possible to overlay the notification about entering full screen mode.
This is taken from Bug 1822305.

<input onclick = 'location.href="tel:1"; document.documentElement.requestFullscreen()'></input>

Comment 1

[Daniel Veditz [:dveditz]]

We might have this on file already, but in the mean time marking it sec-moderate since it's not the default. I believe this particular panel comes up only if the user has multiple apps to handle the protocol and has not chosen a default. Most users find that annoying and will have chosen a default or never installed alternate dialers in the first place.

Comment 2

[Raphael]

Attachment: geo.html

Comment 3

[Raphael]

Attachment: mail.html

I also added an example of geo.html, it may be more suitable as an example.
The other file is not related to mail.html security, but it has strange behavior with the address bar and should be moved to the section of closed bugs.

Comment 4

[Raphael]

The new patch for Nightly v130.0a1 seems to fix this bug.

Comment 5

[Raphael]

Could you take a look?

Comment 6

[Polly [:polly]]

thanks for the shout Raphael!
You are right - i have retested this issue on nightly 130.0a1, and the fullscreen notification toast now appears above the Open With... dialog.
So marking this as fixed. Appreciate the heads up! :)

Comment 7

[Daniel Veditz [:dveditz]]

This bug will be referenced in the advisory for the fix (bug 1902996)