Adding RB label as this is a recent regression.

Ah yeah, this is a security problem. The order in which the prompts are shown determines their stacking order. It's now possible to cause the permission prompt bubble to appear in front of the fullscreen notification, which means a site can enter fullscreen, then immediately request location, to mask the fullscreen bubble completely.

The previous behaviour ( Issue 619894 ) was weird but not a security issue, so we could just revert to that. I'll see how easy it is to fix the stacking order.

It is really hard to fix the stacking order :(. I think a good fix for this is to just move the permission prompt over to the top-left corner and give it an arrow treatment (similar to when out of fullscreen mode). See  Issue 624296 .

CL: https://codereview.chromium.org/2109663005

Sorry to do this after already spending people's time on the previous CL.

Deleted: fullscreen-permission-corner.png 121 KB

	fullscreen-permission-corner.png 121 KB View Download

I love this solution!

> Note: Issue is not seen on Mac OS.

Wait, I just tested on macOS and it *is* reproducible. That's concerning because r402133 couldn't have caused this (it must have been an issue on Mac the whole time). My above CL is not going to fix on Mac either. (In some sense this is less severe on Mac because it's not a regression.)

My CL won't be able to land by branch point (there are some issues with RTL as well as multi-monitor). I'll try to merge it later. I don't think it's correct to revert the previous CL as that re-introduces a different bug.

I also tried a different approach, changing the stacking order:
https://codereview.chromium.org/2115433002

This works on Views but not Mac. So... I'm not clear on whether we should land both of these or just one. I think the one that moves it to the corner is desirable anyway, and Ben said he would be able to do it on Mac, so I think we'll go with that one.

M53 is branched today (2785) and will be promoted to Beta this month.Your bug is labelled as Beta ReleaseBlock, pls make sure to land and merge the fix to M53 branch 2785 by 5:00 PM PST on Friday 07/22 (sooner the better so it gets chance to bake in M53 dev releases it self). Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/22beefb92cb521c2aa381431b7041f2d488c7227

commit 22beefb92cb521c2aa381431b7041f2d488c7227
Author: mgiuca <mgiuca@chromium.org>
Date: Wed Jul 06 02:25:04 2016

Permission prompts show in the top-left corner in fullscreen mode.

Previously they were shown in the center, which causes interference with
the fullscreen notification. This way, they are treated more
consistently both in and out of fullscreen mode.

BUG= 623862 , 624296 
TEST=On https://permission.site, click Fullscreen then Location. The location
  prompt should be in the top-left corner and not overlapping the "Press Esc to
  exit full screen" bubble.
TEST=As above, but with the browser window on a secondary monitor.
TEST=As above, but in Arabic or Hebrew language (should be in top-right corner).

Review-Url: https://codereview.chromium.org/2109663005
Cr-Commit-Position: refs/heads/master@{#403840}

[modify] https://crrev.com/22beefb92cb521c2aa381431b7041f2d488c7227/chrome/browser/ui/views/website_settings/permissions_bubble_view.cc
[modify] https://crrev.com/22beefb92cb521c2aa381431b7041f2d488c7227/chrome/browser/ui/views/website_settings/permissions_bubble_view.h
[modify] https://crrev.com/22beefb92cb521c2aa381431b7041f2d488c7227/chrome/browser/ui/views/website_settings/permissions_bubble_view_views.cc

Fixed on Views. Reported  Issue 625915  for Mac (which is a non-regression).

Requesting merge to M53 (rationale: regressed in M53).

Your change meets the bar and is auto-approved for M53 (branch: 2785)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2735281192ab10e3930275697983a06df06b8171

commit 2735281192ab10e3930275697983a06df06b8171
Author: Matt Giuca <mgiuca@chromium.org>
Date: Thu Jul 07 03:07:35 2016

Permission prompts show in the top-left corner in fullscreen mode.

Previously they were shown in the center, which causes interference with
the fullscreen notification. This way, they are treated more
consistently both in and out of fullscreen mode.

BUG= 623862 , 624296 
TEST=On https://permission.site, click Fullscreen then Location. The location
  prompt should be in the top-left corner and not overlapping the "Press Esc to
  exit full screen" bubble.
TEST=As above, but with the browser window on a secondary monitor.
TEST=As above, but in Arabic or Hebrew language (should be in top-right corner).

Review-Url: https://codereview.chromium.org/2109663005
Cr-Commit-Position: refs/heads/master@{#403840}
(cherry picked from commit 22beefb92cb521c2aa381431b7041f2d488c7227)

Review URL: https://codereview.chromium.org/2127703006 .

Cr-Commit-Position: refs/branch-heads/2785@{#38}
Cr-Branched-From: 68623971be0cfc492a2cb0427d7f478e7b214c24-refs/heads/master@{#403382}

[modify] https://crrev.com/2735281192ab10e3930275697983a06df06b8171/chrome/browser/ui/views/website_settings/permissions_bubble_view.cc
[modify] https://crrev.com/2735281192ab10e3930275697983a06df06b8171/chrome/browser/ui/views/website_settings/permissions_bubble_view.h
[modify] https://crrev.com/2735281192ab10e3930275697983a06df06b8171/chrome/browser/ui/views/website_settings/permissions_bubble_view_views.cc

Verified the issue on Win 7 and Ubuntu 14.04 using 53.0.2785.14 and its working fine.

Deleted: 623862_July_12.mp4 1.2 MB

	623862_July_12.mp4 1.2 MB View Download

Verified as per initial bug repro steps. Permission bubble appears in the top-left corner and does not hide 'Press Esc to exist fullscreen' infobar.

Build: ChromeOS 8530.35.0, 53.0.2785.36