The POC causes a script error; it needs .webkitRequestFullscreen I believe.
https://bayden.com/test/fullscreenandauth.html

I'm not exactly clear on your attack scenario; if a user types their credentials into the HTTP auth dialog, those are conveyed to the legitimate (api.stripe.com) domain.

So I think this boils down to the same "dialogs should cause exit of full-screen, otherwise the YouHaveGoneFullScreen notice can get overlapped" bug of which there are four or five copies now.

Assigning to Avi who is already investigating what to do with all bugs of this ilk.

Merging into  Issue 812769  - same cause.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3d41e77125f3de8d722b6d8303599abaf2a91667

commit 3d41e77125f3de8d722b6d8303599abaf2a91667
Author: Avi Drissman <avi@chromium.org>
Date: Mon Aug 27 21:18:08 2018

If a dialog is shown, drop fullscreen.

BUG= 875066 ,  817809 , 792876,  812769 ,  813815 
TEST=included

Change-Id: Ic3d697fa3c4b01f5d7fea77391857177ada660db
Reviewed-on: https://chromium-review.googlesource.com/1185208
Reviewed-by: Sidney San Martín <sdy@chromium.org>
Commit-Queue: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#586418}
[modify] https://crrev.com/3d41e77125f3de8d722b6d8303599abaf2a91667/chrome/browser/ui/browser.cc
[modify] https://crrev.com/3d41e77125f3de8d722b6d8303599abaf2a91667/chrome/browser/ui/browser_browsertest.cc
[modify] https://crrev.com/3d41e77125f3de8d722b6d8303599abaf2a91667/content/browser/web_contents/web_contents_impl.cc
[modify] https://crrev.com/3d41e77125f3de8d722b6d8303599abaf2a91667/content/browser/web_contents/web_contents_impl.h
[modify] https://crrev.com/3d41e77125f3de8d722b6d8303599abaf2a91667/content/browser/web_contents/web_contents_impl_browsertest.cc

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot