1908488 - (CVE-2025-1940) Intent dialog tapjacking using Select option

Status: RESOLVED FIXED

(Firefox for Android :: General, defect, P2)

Description

[Shaheen Fazim]

Attachment: poc.html

On Firefox for Android, using a delayed select option dialog, we could cover the intent dialog with custom attacker content and tapjack the victim into unknowingly launching any Android intent.

Steps to Reproduce:
1 . Download the file poc.html to a folder
2. Start a Python server on the same folder by running the command python -m http.server 8080.
3. Open the Android Firefox browser and navigate to the server at http://{YOUR-SERVER-IP}:8080/poc.html to Begin testing.

Comment 1

[Shaheen Fazim]

While reporting this issue, I am aware of the previously reported Bug 1836921, but I believe both are different (different fix!). While Bug 1836921 straight-up tapjacks the dialog, this bug uses a select option overlay to cover it. Therefore, we require extra measures to prevent such vulnerability.

Comment 2

[Shaheen Fazim]

Attachment: demo.mp4

Video Demonstration.

Comment 3

[Daniel Veditz [:dveditz]]

Almost certainly the fix for bug 1836921 (add a delay protection to that dialog) will function the same here and fix this too, but I'm OK with making this "depend on" that one in the off chance that for some reason the select doesn't restart the timer.

Comment 4

[Daniel Veditz [:dveditz]]

(In reply to Daniel Veditz [:dveditz] from comment #3)

Almost certainly the fix for bug 1836921 [will] fix this too

Of course I also thought bug 1909298 should have been fixed by bug 1836786 and that didn't work out. Watch out for minor timing differences when trying to fix timing-based attacks :-(

Comment 5

[:Gela]

Before jumping into implementing anything, I'd like to brainstorm the best way to prevent against this. Do you think delaying the selection is the way to go here? Frankly I can't think of a clever way to resolve this.

Comment 6

[Shaheen Fazim]

Delaying the selection process is one potential approach. Alternatively, we could completely restrict the selection from opening until the user grants permission for the intended action. Once the user is done with intent, they would then be allowed to access the selection option.

Another approach involves detecting whether the intent dialogue is in focus. If it becomes unfocused due to the selection option or any other dialogues, we can reset the timer. This ensures that the user can interact with the selection option and proceed with the intent after a respectful delay, effectively preventing tapjacking.

Comment 7

[Shaheen Fazim]

Another way is to always show important dialogues, like the intent dialogue, in the foreground if possible, while less important ones open in the background.

Now we’ve got four options:

1. Delay the selection process to give the user more time.
2. Completely block new dialogues, like the selection option, from popping up while the intent dialogue is active.
3. Allow the prompt to open on top, but reset the timer for the hidden dialogue when it regains focus after losing it.
4. Always keep important dialogues, like the intent dialogue, focused on top/foreground if possible.

Comment 8

[Shaheen Fazim]

Option 2 is similar to how most interactions I've seen are handled in browsers. I think doing this on Android as well would prevent two dialogues from opening at once. Instead, only one dialogue would open at a time per click/tap, and the first one would consume the user's activation (in a single tap). After that, it would require an additional explicit click/tap from the user to open the next dialogue.

Comment 9

[twhite]

Thanks for your input and ideation here Shaheen!

Completely block new dialogues, like the selection option, from popping up while the intent dialogue is active.

I think this is the best solution to move forward with.

Comment 10

[Tara Jorjani [:Tara]]

Attachment: Bug 1908488 - Improve dialogs.

Comment 11

[Tara Jorjani [:Tara]]

Attachment: Bug 1908488 - Improve dialog tests.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/12e182eaf8db
Improve dialogs. r=android-reviewers,gmalekpour

Comment 13

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/mozilla-central/rev/12e182eaf8db

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:tjorjani, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox136 to wontfix.

For more information, please visit BugBot documentation.

Comment 15

[Tara Jorjani [:Tara]]

Letting this ride the trains since it is S3

Comment 16

[Donal Meehan [:dmeehan]]

(In reply to Tara Jorjani [:tjorjani] from comment #15)

Letting this ride the trains since it is S3

:tjorjani though it's an S3, it's a secbug with sec-moderate rating. We should still uplift this?
:dveditz if you have anything to add?

Comment 17

[Tara Jorjani [:Tara]]

(In reply to Donal Meehan [:dmeehan] from comment #16)

(In reply to Tara Jorjani [:tjorjani] from comment #15)

Letting this ride the trains since it is S3

:tjorjani though it's an S3, it's a secbug with sec-moderate rating. We should still uplift this?
:dveditz if you have anything to add?

I don't have a strong preference, I'm good with uplifting it. I will wait a bit first to see if :dveditz has something to say.

Comment 18

[Daniel Veditz [:dveditz]]

Yes, let's uplift this.

Comment 19

[Tara Jorjani [:Tara]]

Comment on attachment 9463591 [details]
Bug 1908488 - Improve dialogs.

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: This is a security bug with a sec-moderate rating. This patch contains the fix to prevent attackers from being able to tapjack victims by having them unknowingly launch any Android intent.
• Is this code covered by automated tests?: Not included currently, but automated tests will be landed later.
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce:
  1 . Download the file poc.html to a folder

2. Start a Python server on the same folder by running the command python -m http.server 8080.
3. Open the Firefox for Android browser and navigate to the server at http://{YOUR-SERVER-IP}:8080/poc.html to begin testing.
4. Click on "Test Intent"
5. Verify that only the intent dialog appears

• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a small patch that adds a simple condition affecting when the prompt dialog can be shown. In addition, the automated testing for this patch would be landed soon.
• String changes made/needed: None
• Is Android affected?: Yes

Comment 20

[Donal Meehan [:dmeehan]]

Comment on attachment 9463591 [details]
Bug 1908488 - Improve dialogs.

Approved for 136.0b6

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/f23bec7ea3ea

Comment 22

[Daniel Veditz [:dveditz]]

Attachment: advisory.txt

Comment 23

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/30d9564a6711
Improve dialog tests. r=android-reviewers,gmalekpour,twhite

Comment 24

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/30d9564a6711

Comment 25

[Mira Lobontiu (Android QA)]

Attachment: 1000000243.mp4

Verified on the latest Firefox for Android versions: 141.0 build 1, Beta 141.0b9, and Nightly 142.0a1 from 7/17, with a Samsung Galaxy S24 (Android 15) - I've attached a short video with the behavior.
Please let us know if there is enything else or different we should test.