Issue metadata
Sign in to add a comment
|
Security: trap user in full-screen
Reported by
mischa.r...@gmail.com,
Jan 4 2017
|
||||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS Javascript function webkitRequestFullScreen() is not handled correctly which allows attacker to capture and hijack a users browser in full-screen mode Other browsers ask permission to enable full-screen, yet chrome serves a full-screen mode view with an escape-button icon VERSION Chrome Version: 55 + stable Operating System: Windows, Linux, Mac OS X REPRODUCTION CASE Load malicious website and let the user click anywhere on the screen (the screen is completely layered over with a div, which if clicked forces full screen).
,
Jan 4 2017
Repro works in Chrome 55 (escape dismisses momentarily, but full-screen reappears). Repro doesn't work in Chrome 57 (escape dismisses, but full-screen does not restart until user interacts again)
,
Jan 4 2017
,
Apr 13 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Jan 4 2017