Security issue with tapjacking

[ArcherEmiya05]

Step 1: Are you in the right place?

Yes

Step 2: Describe your environment

• Android device: N/A
• Android OS version: 21 up to 32
• Google Play Services version: 4.3.10
• Firebase/Play Services SDK version: 21.0.5
• FirebaseUI version: 8.0.1

Step 3: Describe the problem:

Steps to reproduce:

Use FirebaseUI Auth UI

Observed Results:

Security risk level is medium

Expected Results:

Possible use of filterTouchesWhenObscure set to true?

Relevant Code:

// TODO(you): code here to reproduce the problem

[thatfiredev]

Thanks for reporting this @ArcherEmiya05
We'll consider setting filterTouchesWhenObscure to true.

Contributions are also welcome :)

[demolaf]

Hello,

Thank you for taking the time to submit this bug.

This is a great idea and definitely something we can consider for the future. It is not currently prioritized for our immediate new version roadmap, as we are focusing on a new upcoming release.

In the meantime, we will keep this issue open so we can revisit it during a later planning cycle, particularly as we gather more feedback from the community.