1894891 - The Google password manager form overlaps fullscreen mode warnings, which could lead to address bar phishing.

Status: RESOLVED FIXED

(Firefox for Android :: Autofill, defect, P3)

Description

[Raphael]

Attachment: poc.html

When a user enters their login and password into the authentication form, a prompt appears suggesting to save their credentials. In my case, two prompts appear. If we add a fullscreen mode activation function to the authentication button, the browser will not block such behavior.

We can also implement a double-click on the button: the first click activates fullscreen mode, and the second click sends the authentication request. I can provide an example of such implementation upon request.

Comment 1

[Raphael]

Attachment: video.mp4

Comment 2

[Daniel Veditz [:dveditz] back January 5, 2026]

This appears to be a Google password saving dialog, not ours, which is a recent Android feature. It looks similar to the WebAuthn one when you can't read the text :-)

You can decline this so it would not affect every user, but it will probably be pretty popular if it does a decent job. It might show up if you're on a page where you've already saved a password. This attack seems to rely on the user entering a password on a page they have not saved a password for, which would be extremely unusual if it's the attacker's site. Maybe it's a phishing site and the user already thinks they're somewhere else, but then they've entered their password and you've already won. What's the value of spoofing fullscreen at that point?

Comment 3

[Raphael]

Attachment: video2.mp4

I apologize for the poor implementation example, it is indeed a bad practice to ask users to enter their login and password on an unknown website. I have changed the code so that users no longer need to enter their login and password. I have also hidden the fields.

Comment 4

[Raphael]

Attachment: poc2.html

Comment 5

[Andrew McCreight (out until 2026) [:mccr8]]

Ah, right. Thanks. I'll increase the rating.

Comment 6

[Titouan Thibaud [:titouan]]

Polly has been working on a proposal for a way to fix all those issues more reliably. We'll bring more details here as soon as we have some results.

Comment 7

[Raphael]

The new patch for Nightly v130.0a1 seems to fix this bug.

Comment 8

[Daniel Veditz [:dveditz] back January 5, 2026]

This bug will be referenced in the advisory for the fix (bug 1902996)