Bug: Address Bar Spoofing via Suppression of Fullscreen Exit Notifications on Windows 11 Firefox version 134.0.1
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2025-01-23 09:31:30+00:00
Resolved: 2025-02-12 23:02:50+00:00

## Hi Team,

I hope this message finds you well. :)

- During my research on Firefox version 134.0.1, I discovered an address bar spoofing vulnerability in Fullscreen mode.
- By triggering multiple file downloads in Fullscreen mode, the "Press esc to exit full screen and see download" notification can be suppressed.
- Instead, only the "Download started, to see it press esc" notification appears.
- This issue can lead to address bar spoofing and user deception, as critical Fullscreen exit prompts are removed, and multiple files (e.g., APKs) are downloaded without visible notifications.

## Affected Version:

- Browser Version: Firefox 134.0.1
- Operating System: [ Windows 11]

## Proof of concept:

- I have uploaded the proof-of-concept videos and exploit file in this report for your review and reproductions.

## Reference:

- "For additional context or a similar issue, please refer to the Chromium bug tracker at https://issues.chromium.org/issues/40073817."

## Impact:

- This vulnerability enables attackers to:
- Spoof the browser address bar in Fullscreen mode by preventing users from easily exiting Fullscreen, misleading them about the webpage’s authenticity.
- Silently initiate multiple file downloads, which users may not notice until after the attack has occurred.
- Exploit user trust in the absence of critical Fullscreen exit notifications, leading to phishing attacks or other malicious activities.

## Steps to Reproduce:

- Load the Proof of Concept (PoC):
- Open the downloadspoof5.html file in Firefox.
- Trigger Fullscreen Mode and Downloads:
- Click the "Click Here" button two times or more to enter Fullscreen mode.
- Observe the notification that appears: "Download started, to see it press esc."
- Suppress Fullscreen Exit Notification:
- While in Fullscreen mode, click the "Click Here" button again multiple times to initiate more downloads.
- Observe that the "Press esc to exit full screen and see download" notification no longer appears.
- Exit Fullscreen and Verify Downloads:
- Press Esc to exit Fullscreen mode.
- Check the number of files downloaded and note the lack of clear download notifications during the attack.

## Expected Behavior:

- The "Press esc to exit full screen and see download" notification should always be displayed in fullscreen mode, regardless of the number of downloads triggered.

## Observed Behavior:

- The "Press esc to exit full screen and see download" notification is suppressed after multiple download actions.
- Users only see the "Download started, to see it press esc" notification, which reduces awareness of how to exit Fullscreen.
- Multiple files are downloaded without proper notifications, increasing the risk of unnoticed or malicious downloads.

## Mitigation:

- Enforce persistent Fullscreen exit prompts: Ensure that the "Press esc to exit full screen" notification is always visible when Fullscreen mode is active.
- Rate-limit download notifications: Prevent excessive download-triggered notifications in Fullscreen mode.
- Enhance user awareness: Clearly indicate ongoing downloads and provide a consistent mechanism to verify file downloads while in Fullscreen.