New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 592686 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug-Security



Sign in to add a comment

Wrong tab goes fullscreen

Project Member Reported by palmer@chromium.org, Mar 7 2016

Issue description

Reported publicly: https://twitter.com/herrcore/status/706906335674298370/photo/1

<button onclick="fsBypass(document.documentElement);">Launch fullscreen
bypass</button>
<script>
function fsBypass(element) {
  element.webkitRequestFullScreen();
  window.open("https://test.nope/evil.html");
}
</script>

mgiuca, if you arne't the right person, could you please pass it on to someone who is? Thanks!


 
Cc: nasko@chromium.org
+nasko in case it's related to navigation.
The original finder had another version (https://twitter.com/herrcore/status/706908497481437184) using Flash; not sure if this is the same root cause.
(Note: This bug is unrestricted because it's already been reported publicly.)

Comment 4 by nasko@chromium.org, Mar 7 2016

Cc: alex...@chromium.org
Project Member

Comment 5 by ClusterFuzz, Mar 10 2016

Status: Assigned (was: Available)
Project Member

Comment 6 by sheriffbot@chromium.org, May 4 2016

Labels: -Pri-1 Pri-2
Project Member

Comment 7 by sheriffbot@chromium.org, May 26 2016

Labels: -M-50 M-51
Project Member

Comment 8 by sheriffbot@chromium.org, Jul 21 2016

Labels: -M-51 M-52
Project Member

Comment 9 by sheriffbot@chromium.org, Sep 1 2016

Labels: -M-52 M-53
Cc: mgiuca@chromium.org
Owner: spqc...@chromium.org
Oh man, this fell off my radar.

I investigated. It is Mac-only. On Linux, window.open kicks you out of fullscreen mode.

On Mac, it goes into fullscreen, then creates a new tab and switches to the new tab, but remains in a weird fullscreen mode. You don't see the fullscreen bubble. You can't press Esc to exit. You can only exit by using the View -> Exit Fullscreen menu.

Also tried a few variants. This one does *not* work (it kicks you out of fullscreen):

  element.webkitRequestFullScreen();
  setTimeout(() => window.open("https://test.nope/evil.html"), 0);

So it is just a weird edge case where you create and switch to a new tab while in the same event loop that entered fullscreen mode. I had a brief look at the code (chiefly browser_window_controller.mm) but I really am not familiar with how either fullscreen or window.open work on Mac. So assigning to spqchan who has worked on fullscreen stuff on Mac.
Project Member

Comment 11 by sheriffbot@chromium.org, Oct 13 2016

Labels: -M-53 M-54
Components: -Security>UX
Labels: Team-Security-UX
Project Member

Comment 13 by sheriffbot@chromium.org, Dec 2 2016

Labels: -M-54 M-55
Project Member

Comment 14 by sheriffbot@chromium.org, Jan 26 2017

Labels: -M-55 M-56
Project Member

Comment 15 by sheriffbot@chromium.org, Mar 10 2017

Labels: -M-56 M-57
Project Member

Comment 16 by sheriffbot@chromium.org, Apr 20 2017

Labels: -M-57 M-58
Status: Fixed (was: Assigned)
Sorry I haven't responded to this in a while. I fixed this in another bug sometime ago (involving Flash). 

There was a race condition with the fullscreen UI which puts the browser in an unusual fullscreen state. The browser will now kick you out of fullscreen. Feel free to reopen if there are still any issues
Project Member

Comment 18 by sheriffbot@chromium.org, May 24 2017

Labels: Restrict-View-SecurityNotify
Project Member

Comment 19 by sheriffbot@chromium.org, Aug 30 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment