1954137 - (CVE-2025-5267) Autofill clickjacking Leads to Credit Card Leak

Status: VERIFIED FIXED

(Toolkit :: Form Autofill, defect, P2)

Description

[Ameen Basha M K]

Attachment: test.html

HI team, Firefox latest on windows is vulnerable for autofill tapjackking which allows the attacker to trick the victim to leak the saved card details

Steps to reproduce

1. Host and open the html file on firefox latest
2. Click the button rapidly (after 7th click the attack starts)
3. you can see the credit card details are leaked

Note: for poc i have alerted the details. if not, the victim will not even aware of this attack other than just a seconds of dropdown shown.

I have attached the poc video and html file for reference

Comment 1

[Ameen Basha M K]

Attachment: FIrefox-Autofill-tapjackking.mp4

Comment 2

[Daniel Veditz [:dveditz]]

Emma: perhaps my question in bug 1954262 really belongs in this bug.

Comment 3

[Emma Zühlcke [:emz]]

I've answered most of the questions there. One thing to add: while the autofill UI seems to have a security delay, the security delay is not extended when the user clicks it while the element is disabled. This is important to mitigate attacks like the one described in this bug where a user ist told to spam click.

Comment 4

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:dimi, could you have a look please?

For more information, please visit BugBot documentation.

Comment 6

[Dimi Lee [:dimi]]

I'll work on a fix that:

1. Only shows the autocomplete popup for real user events.
2. Renews the autocomplete popup secure delay when users click the popup while the element is disabled.

Comment 7

[Dimi Lee [:dimi]]

Attachment: Bug 1954137 - refresh timer when needed r=NeilDeakin

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c1e9a6e513dc
refresh timer when needed r=NeilDeakin

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/c1e9a6e513dc

Comment 10

[Dimi Lee [:dimi]]

Although "leave-open" was set, the bug was still closed after the patch landed. Chatted with :Ryan, and he suggested filing another bug to track the remaining issue.
Filed Bug 1963301 for the fix of the "Only show the autocomplete popup for real user events" part.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Did you want to nominate this for ESR128 uplift?

Comment 12

[Dimi Lee [:dimi]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #11)

Did you want to nominate this for ESR128 uplift?

The fix itself is not very complicated, so I think we could uplift it. However, since this has been triaged as sec-low,
I’m not sure if it's necessary.
Simon, from the security team's perspective, do you think we should uplift this to ESR128?

Comment 13

[Simon Friedberger [:simonf]]

The fix seems tiny and local so I would suggest uplifting.

Comment 14

[Dimi Lee [:dimi]]

Attachment: Bug 1954137 - refresh timer when needed

Original Revision: https://phabricator.services.mozilla.com/D246212

Comment 15

[Phabricator Automation]

firefox-esr128 Uplift Approval Request

• User impact if declined: Vulnerable to autofill clickjacking if users are tricked into repeatedly clicking.
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: Low
• Explanation of risk level: The fix itself is straightforward and not complicated
• String changes made/needed: no
• Is Android affected?: no

Comment 16

[Catalin Sasca, Desktop Test Engineering [:csasca]]

Reproduced the issue on Firefox 138.0a1 (2025-03-14) on Windows 11 by following the infos provided in Comment 0.

The autocomplete popup secure delay is fixed on Firefox 139.0b7 and Firefox 140.0a1 (2025-05-12).

Comment 17

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/19e3e36dd135

Comment 18

[Catalin Sasca, Desktop Test Engineering [:csasca]]

Verified this as well on Firefox 128.11.0 ESR on Windows 11.

Comment 19

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt