1902131 - Select Options Can Escape Across Tabs

Status: RESOLVED DUPLICATE of bug 1875354

(Core :: DOM: Core & HTML, defect)

Description

[hyeon park]

Attachment: poc.html

Using the select option and showPicker(), an attacker could overlay content on other tabs from a malicious site.
Below is a proof-of-concept page; when a victim clicks on a malicious site, the select options are displayed over other tabs opened by the victim.
Also, this selection option is still active not only inside the browser but also outside the browser. This is different from existing bug cases.

Comment 1

[hyeon park]

Reproduction CASE

1. Download the poc.html file.
2. Open the poc.html file in the firefox browser.
3. Open a different website (this can also be done later) and interact with the malicious site by clicking anywhere. Check if the select option for the malicious site is shown on every tab the user tries to visit.

Comment 2

[hyeon park]

Attachment: poc_firefox_select_2.png

Comment 3

[hyeon park]

Attachment: poc_firefox_select_1.png

Comment 4

[Daniel Veditz [:dveditz]]

This is probably a duplicate of other showpicker bugs, like some of the dependencies of bug 1877969. It doesn't seem to depend on bug 1877969 itself because it is not about evading the user-interaction requirement.

Comment 5

[hyeon park]

The link below is a Chrome browser issue that explains the same issue. It would be good to refer to it.

https://issues.chromium.org/issues/41494315

Comment 6

[Tom Schuster]

This seems fixed to me in Nightly. Can you confirm?

Comment 7

[Tom Schuster]

I bisected the fix for this to bug 1875354 and the POC here just seems to be a simpler version of the other one.

Comment 8

[Tom Schuster]

No reply