CVE-2023-29534

Vulnerability

Multiple techniques existed in Firefox for Android and Focus for Android that could obscure the fullscreen notification toast. These include using an HTML select element to trigger a floating panel [1], launching an Android intent (e.g., Google Assistant) via a URI [3], and having the system keyboard appear in landscape mode [4]. All methods could hide the fullscreen notification from the user. Affected versions: Firefox for Android < 112 and Focus for Android < 112 [2].

Exploitation

An attacker hosts a malicious webpage and entices the user to visit it on the affected browser. The page triggers a fullscreen request while simultaneously launching another UI element (select dropdown, intent prompt, or keyboard) that overlays the fullscreen notification. For example, clicking a button can trigger both fullscreen and select option dialogs simultaneously [1]. The user may not see the fullscreen notification and could be presented with a spoofed interface.

Impact

Successful exploitation allows an attacker to obscure the fullscreen notification, leading to user confusion and potential spoofing attacks. The user may be tricked into granting permissions (e.g., camera, microphone) or interacting with a fake UI, thinking they are in a normal page context [2].

Mitigation

This vulnerability is fixed in Firefox for Android 112 and Focus for Android 112 [2]. Users should update their browsers to these versions or later. No other workarounds are available, as the fix involves redesigning the fullscreen notification mechanism [1][4].