I've reported this as a bug here: https://bugzilla.mozilla.org/show_bug.cgi?id=1758975

Wow, with the line of code found in under an hour.

Mozregression looks amazing: https://mozilla.github.io/mozregression/

It's now 8 days later, and it's fixed in the nightly build. Although in contrast to what it says in the blog post, it's a perfectly white square.

This feels like the equivalent of patching the ai in GTA cars, so they can no longer randomly crash into each other and cause huge pileups. If no one can turn it into a working exploit, it should be left alone for the sheer weird/cool factor.

I agree, but it does feel like it has a lot of exploit potential.

If Firefox is maximized I just see other text on the page as I scroll. If I make it a floating window I sometimes see other page content and sometimes see the window below. Very strange.

I wonder if this could be used for some sort of phishing attack by tricking the user into thinking it is some OS trusted dialog or just showing that you know something secret so you should be trusted (would be hard to set up to work with any sort of probability though).

I took a screenshot[0] using the firefox utility and the result is a black rectangle.

It's even funnier when I open the dev tools, the transparent image is replaced by a violet rectangle, blinks a few times then stay violet[1]!

[0]: https://up.l3m.in/file/1646929301.png [1]: https://up.l3m.in/file/1646929762-a.webm

Same for me, I can see my wallpaper and desktop icons. Very strange. Wonder if this is a risk for being exploited somehow to take photos of people's desktops

I wrote a simple HTML and JS to test if that's possible: Load this GIF, then draw it into a canvas using drawImage[1], then read the canvas content with getImageData. Luckily it returns an array of zeros, so it at least not trivially exploitable.

[1] https://developer.mozilla.org/en-US/docs/Web/API/CanvasRende... [2] https://developer.mozilla.org/en-US/docs/Web/API/CanvasRende...

The browser is rendering that region of its window as transparent, and the display compositor is obliging by showing the layers below the browser window. The browser window itself doesn't know anything about the pixels of the layers below it. So anything that looks at the browser window, like canvas.getImageData will not return those pixels.

However screen-sharing API like getDisplayMedia() will screencopy at the compositor level, so they will include those pixels depending on what you choose to share.

Same here on Arch with Firefox (perhaps due to the fact that I'm using a Wayland compositor?). It was quite surprising!

I see the desktop background through it on Archlinux with Firefox, using X with cinnamon. Even if there's another window behind, it shows the desktop background wallpaper

I suppose that the graphical library simply copies the raw values to output pixels without interpreting them (as it should). In true 256 color mode (on old systems, before the effective deprecation of all the color conversion and matching routines) that would probably use the current palette. In the early 90s, if you had a lot of GIFs sharing the same palette, and knew that the program displaying them had already set it once, you could skip implementing all the palette handling.

Haha - it punctured your Firefox window!

Here (Firefox on Manjaro X11) I get a HOM effect inside the square while scrolling and with whatever window was previously on top of the square. Sometimes it also renders a little bit of what was behind the window too.. very curious indeed.

Same here with Firefox on GNOME on Arch.

I do have amusement when the author says it's a black square on every renderer he's tried, but we trivially trigger something else :)

Seems like he's on Mac OS X and so I guess it's down to platform quirks.

Same here, FF on Ubuntu, it's like a rectangle was cut out of the browser window.

Very interesting discovery. Can you share a screenshot?

It's nothing special. Relevant part: https://snipboard.io/Izntmp.jpg

Maybe this screenshot is clearer since it shows the full desktop (Debian, KDE, X): https://i.imgur.com/Aqy3Twm.png.

Okay this had me giggling like an idiot. That's a hell of a bug.

Curious if it's exploitable.

I think JS can only read pixels from the screen within a Canvas, which likely would just return the canvas colors not the background. Maybe there's some complicated ninja social engineering you could do using this, but I doubt it.