Closed Bug 1984370 Opened 1 year ago Closed 1 year ago

Focus doesn't show the subdomain in Custom Tabs

Categories

(Focus :: General, defect)

All
Android
defect

Tracking

(firefox142 wontfix, firefox143 wontfix, firefox144+ fixed)

RESOLVED FIXED
144 Branch
Tracking Status
firefox142 --- wontfix
firefox143 --- wontfix
firefox144 + fixed

People

(Reporter: michel, Assigned: michel)

References

Details

(Keywords: csectype-spoof, reporter-external, sec-low, Whiteboard: [adv-main144-])

Attachments

(1 file)

48 bytes, text/x-phabricator-request
Details | Review

This is the same bug 1979534 as in Fenix.

Steps to reproduce

  1. Open an app that displays links using custom tabs. This could be an email client, a messaging app, or a social media app. I tested it with the Mastodon app and a custom-built app.
  2. Send a link to a Google Sites page, such as https://sites.google.com/view/myevilwebsite. The link can be embedded indirectly (e.g., behind several redirects or within an HTML message), so the final destination may not be obvious before clicking.
  3. Tap the link and confirm it opens in a Firefox Custom Tab.

Expected behavior

It should be possible to tell the difference between a Google Sites website and an official Google website. While it's unfortunate that Google allows custom user content under a subdomain of google.com, that's a case that should be handled by Firefox. I propose to show the whole domain, but with the subdomain in a different (secondary) color in Custom Tabs.

Actual behavior

In the Custom Tab only the google.com registrable domain (eTLD+1) is displayed in the urlbar. This makes it easy to confuse a Google Sites website with malicious content for an official Google page.

Attached file (secure)
Pushed by plingurar@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/d239bda81bbb https://hg.mozilla.org/integration/autoland/rev/3be721958830 Set toolbar URL colors and show subdomain in Focus custom tabs. r=petru,mcarare,android-reviewers
Group: mobile-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → 144 Branch
QA Whiteboard: [sec] [qa-triage-done-c145/b144]

Depends on ColoredDomain implemented in the Fenix version of this, bug 1979534

Depends on: CVE-2025-11720
Whiteboard: [adv-main144+]
Whiteboard: [adv-main144+] → [adv-main144-]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: