Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionClickjacking issue in Firefox for Android
ComponentCore
Bug ClassLogic Error
Tracker1978587
Fix commitd29886aa0109 (firefox) +35/-1
CISA KEVNot listed
CreditedHafiizh
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
if
mobile/android/android-components/components/feature/sitepermissions/src/main/java/mozilla/components/feature/sitepermissions/SitePermissionsDialogFragment.kt
modified
if
mobile/android/fenix/app/src/main/java/org/mozilla/fenix/customtabs/ExternalAppBrowserActivity.kt
modified

Files Changed

  • mobile/android/android-components/components/feature/sitepermissions/src/main/java/mozilla/components/feature/sitepermissions/SitePermissionsDialogFragment.kt
  • mobile/android/android-components/components/support/utils/src/main/java/mozilla/components/support/utils/OnEnterAnimationCompleteListener.kt
  • mobile/android/fenix/app/src/main/java/org/mozilla/fenix/customtabs/ExternalAppBrowserActivity.kt
diff --git a/mobile/android/android-components/components/feature/sitepermissions/src/main/java/mozilla/components/feature/sitepermissions/SitePermissionsDialogFragment.kt b/mobile/android/android-components/components/feature/sitepermissions/src/main/java/mozilla/components/feature/sitepermissions/SitePermissionsDialogFragment.kt
index 8a9fdbc2b75..5cec43edd73 100644
--- a/mobile/android/android-components/components/feature/sitepermissions/src/main/java/mozilla/components/feature/sitepermissions/SitePermissionsDialogFragment.kt
+++ b/mobile/android/android-components/components/feature/sitepermissions/src/main/java/mozilla/components/feature/sitepermissions/SitePermissionsDialogFragment.kt
@@ -32,6 +32,7 @@ import mozilla.components.support.base.log.logger.Logger
 import mozilla.components.support.ktx.android.content.appName
 import mozilla.components.support.ktx.kotlin.ifNullOrEmpty
 import mozilla.components.support.ktx.util.PromptAbuserDetector
+import mozilla.components.support.utils.OnEnterAnimationCompleteListener
 
 internal const val KEY_SESSION_ID = "KEY_SESSION_ID"
 internal const val KEY_TITLE = "KEY_TITLE"
@@ -51,7 +52,9 @@ private const val KEY_IS_NOTIFICATION_REQUEST = "KEY_IS_NOTIFICATION_REQUEST"
 private const val DEFAULT_VALUE = Int.MAX_VALUE
 private const val KEY_PERMISSION_ID = "KEY_PERMISSION_ID"
 
-internal open class SitePermissionsDialogFragment : NoObscuredTouchesDialogFragment() {
+internal open class SitePermissionsDialogFragment :
+    NoObscuredTouchesDialogFragment(),
+    OnEnterAnimationCompleteListener {
 
     private val logger = Logger("SitePermissionsDialogFragment")
 
@@ -134,6 +137,11 @@ internal open class SitePermissionsDialogFragment : NoObscuredTouchesDialogFragm
         feature?.onDismiss(permissionRequestId, sessionId)
     }
 
+    override fun onEnterAnimationComplete() {
+        // Extend the positive button click delay.
+        promptAbuserDetector.updateJSDialogAbusedState()
+    }
+
     private fun Dialog.setContainerView(rootView: View) {
         if (dialogShouldWidthMatchParent) {
             setContentView(rootView)
diff --git a/mobile/android/android-components/components/support/utils/src/main/java/mozilla/components/support/utils/OnEnterAnimationCompleteListener.kt b/mobile/android/android-components/components/support/utils/src/main/java/mozilla/components/support/utils/OnEnterAnimationCompleteListener.kt
new file mode 100644
index 00000000000..e28d6fa8a4c
--- /dev/null
+++ b/mobile/android/android-components/components/support/utils/src/main/java/mozilla/components/support/utils/OnEnterAnimationCompleteListener.kt
@@ -0,0 +1,16 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package mozilla.components.support.utils
+
+/**
+ * Allows forwarding [android.app.Activity.onEnterAnimationComplete] to other classes
+ * (e.g. fragments) that want to participate in handling it.
+ */
+interface OnEnterAnimationCompleteListener {
+    /**
+     * Called when the Activity's entering animation has completed.
+     */
+    fun onEnterAnimationComplete()
+}
diff --git a/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/customtabs/ExternalAppBrowserActivity.kt b/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/customtabs/ExternalAppBrowserActivity.kt
index 4eea492349c..d5d5327685f 100644
--- a/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/customtabs/ExternalAppBrowserActivity.kt
+++ b/mobile/android/fenix/app/src/main/java/org/mozilla/fenix/customtabs/ExternalAppBrowserActivity.kt
@@ -11,6 +11,7 @@ import androidx.annotation.VisibleForTesting
 import androidx.core.net.toUri
 import mozilla.components.browser.state.selector.findCustomTab
 import mozilla.components.browser.state.state.SessionState
+import mozilla.components.support.utils.OnEnterAnimationCompleteListener
 import mozilla.components.support.utils.SafeIntent
 import org.mozilla.fenix.HomeActivity
 import org.mozilla.fenix.ext.components
@@ -92,5 +93,14 @@ open class ExternalAppBrowserActivity : HomeActivity() {
     override fun onEnterAnimationComplete() {
         super.onEnterAnimationComplete()
         isFinishedAnimating = true
+
+        val fragments = supportFragmentManager.fragments.toMutableList()
+        while (fragments.isNotEmpty()) {
+            val fragment = fragments.removeAt(0)
+            if (fragment is OnEnterAnimationCompleteListener) {
+                fragment.onEnterAnimationComplete()
+            }
+            fragments.addAll(fragment.childFragmentManager.fragments)
+        }
     }
 }
Loading diff…