Closed
Bug 1984370
Opened 1 year ago
Closed 1 year ago
Focus doesn't show the subdomain in Custom Tabs
Categories
(Focus :: General, defect)
Tracking
(firefox142 wontfix, firefox143 wontfix, firefox144+ fixed)
RESOLVED
FIXED
144 Branch
People
(Reporter: michel, Assigned: michel)
References
Details
(Keywords: csectype-spoof, reporter-external, sec-low, Whiteboard: [adv-main144-])
Attachments
(1 file)
This is the same bug 1979534 as in Fenix.
Steps to reproduce
- Open an app that displays links using custom tabs. This could be an email client, a messaging app, or a social media app. I tested it with the Mastodon app and a custom-built app.
- Send a link to a Google Sites page, such as
https://sites.google.com/view/myevilwebsite. The link can be embedded indirectly (e.g., behind several redirects or within an HTML message), so the final destination may not be obvious before clicking. - Tap the link and confirm it opens in a Firefox Custom Tab.
Expected behavior
It should be possible to tell the difference between a Google Sites website and an official Google website. While it's unfortunate that Google allows custom user content under a subdomain of google.com, that's a case that should be handled by Firefox. I propose to show the whole domain, but with the subdomain in a different (secondary) color in Custom Tabs.
Actual behavior
In the Custom Tab only the google.com registrable domain (eTLD+1) is displayed in the urlbar. This makes it easy to confuse a Google Sites website with malicious content for an official Google page.
| Assignee | ||
Comment 1•1 year ago
|
||
Updated•1 year ago
|
Pushed by plingurar@mozilla.com:
https://github.com/mozilla-firefox/firefox/commit/d239bda81bbb
https://hg.mozilla.org/integration/autoland/rev/3be721958830
Set toolbar URL colors and show subdomain in Focus custom tabs. r=petru,mcarare,android-reviewers
Comment 3•1 year ago
|
||
Group: mobile-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 1 year ago
status-firefox144:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 144 Branch
Updated•1 year ago
|
status-firefox142:
--- → wontfix
status-firefox143:
--- → affected
tracking-firefox143:
--- → +
tracking-firefox144:
--- → +
Updated•1 year ago
|
tracking-firefox143:
+ → ---
Updated•1 year ago
|
QA Whiteboard: [sec] [qa-triage-done-c145/b144]
Comment 4•11 months ago
|
||
Depends on ColoredDomain implemented in the Fenix version of this, bug 1979534
Depends on: CVE-2025-11720
Whiteboard: [adv-main144+]
Updated•11 months ago
|
Whiteboard: [adv-main144+] → [adv-main144-]
Updated•5 months ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•