9 ms·

Safari on iOS can overlap multiple full-screen videos

125 points by mmazzarolo 4y ago

smoldesu 4y ago
Definitely looks like the kind of bug I'd find exploited on early Internet Explorer. Open a suspicious tab, get spammed with fullscreen ads! Now that's thinking differently.
- LesZedCB 4y ago
  use it against them so sites can charge for a full ad watch, but they are hidden by the content that people actually want to watch.
- Maursault 4y ago
  A bug is an error in source code that causes a program to produce unexpected results or crash altogether, i.e. something that doesn't work, something broken; the user initiates an action, the action fails or program crashes. That isn't what this is. This is the user intentionally opening multiple overlapping fullscreen videos. You can make a computer saturate its processor indefinitely with a while-loop, but doesn't make it a bug.
  - mmazzarolo 4y ago
    I would still consider a missing safety check (like in this case, to check if there’s already a full screen video open) as a bug.
    - Maursault 4y ago
      And I'd agree, except that this behavior is an advertised feature of the of the system, iow, if you open multiple fullscreen videos, you should expect to see what is seen as opposed to Safari crashing or the system crashing.
      - Thorrez 4y ago
        Where is it advertised?
        Maursault 4y ago
        Back in 2010 with the release of iOS 4 and it's multitasking feature, and probably also in 2020 with iOS 14's Picture in Picture mode.
        Thorrez 4y ago
        Hmm, is opening a fullscreen video considered opening a new application, or is it considered a single application (the browser) displaying different content? I thought it was the second case, so multitasking I don't think applies. Same for desktop chrome, when it shows a fullscreen video, that's not a new application, just the browser displaying content in a new way. For picture in picture mode, I don't think multiple fullscreen videos should be a valid configuration of picture in picture.
  - function_seven 4y ago
    The user isn't the one intentionally opening these overlapping videos. The site they're visiting is making that request, and the browser is honoring it. This is a bug. These are unexpected results! And as the article notes, "sometimes this behavior makes Safari crash." So a website can make your browser crash by getting it to do something nonsensical (opening 30 overlapping full screen videos), without your forewarning that this could happen. You can quibble and say it's a "misfeature" or similar, but I'm not sure that means much.
    - Maursault 4y ago
      > The user isn't the one intentionally opening these overlapping videos. Yes, he absolutely is, and the proof is > So here’s a tiny web page I created to play with it. What OP is reporting is more accurately described as a possible memory overflow exploit. The software appears to be operating as designed, but a malicious attacker might be able to exploit the behavior to do bad things, though this is not exactly necessarily true, and we won't know until we see it happen.
      - jaywalk 4y ago
        The person who created the web page is the user? I think you've got that backwards.
        stonemetal12 4y ago
        He found a bug and made a proof of concept webpage to demonstrate it. So when he talks about it he is both the user and the author of the web page. In general You wouldn't expect them to be the same person.
      - function_seven 4y ago
        This is weird. Okay, so it may not be a software bug at all, but I'm gonna move these goalposts and insist this is a product design bug, or something. If this is intentional behavior, I don't understand the point. A full-screen video should be the only one playing IMO. Playing multiple (windowed) videos is one thing, but having 30 of them overlap full screen is quite another. And with no affordances to mass-terminate them, the result is unwanted behavior. So: not a bug in the "off-by-one" or "use-after-free" sense, but damn if it ain't a close cousin.
- isodev 4y ago
  I have a project where this is a legitimate use case. Indeed, Safari was the only browser where it was possible to implement without trickeries… eventually the team managed to get a version for Firefox snd chromiums as well (on desktop too).
  - Thorrez 4y ago
    What is the use case?
  - smoldesu 4y ago
    What is your legitimate use-case for opening multiple overlapping fullscreen video players?
- code_duck 4y ago
  The worst experience I’ve had on iOS, fairly recently, was clicking on a search result and being redirected to a dodgy website which displayed a “your phone has a virus!” pop up, started attempting to call a phone number repeatedly, and somehow corrupted the OS to where I saw a distorted version of the left-hand slide menu from the home screen, could not go to the home screen, close the app or reboot. I managed to reboot through a different method but it’s made me very wary of going to random websites on my phone.
  - r00fus 4y ago
    I've never had this kind of experience for the past 14 years on iOS. How could a website get access to call numbers without interaction?
    - Operyl 4y ago
      It's spamming the modal asking if you want to call x phone number, probably.
      - code_duck 4y ago
        The corruption of the interface was the most disturbing thing. It was showing the left-hand slide home screen menu offset, overlapping with other elements, without any ability to interact with it. It must be some sort of memory corruption vulnerability, I assume. Apple did an update a week or two later which addressed some sort of zero day… So clearly I was wondering exactly how hacked my phone might have been. I was able to reboot and it has seems OK, but who knows.
        Operyl 4y ago
        Apple addresses zero days and security related bugs every single update, I wouldn't get paranoid about a visual glitch on its own honestly.
        code_duck 4y ago
sp332 4y ago
Where is the part that causes these videos to be full screen? I didn't see that in the HTML or JS.
- mnemnc 4y ago
  That‘s at least the default behavior if not the only way to play video on iPhone‘s Safari. iPad Safari however supports non-fullscreen video playback.
  - happyopossum 4y ago
    Fullscreen is definitely not the only way to play video on iOS safari...
  - GranPC 4y ago
    iOS Safari can play videos non-fullscreen with the playsinline or webkit-playsinline attributes. The fun thing though is that this attribute must be enabled manually on each web view, so if some other app is embedding your page and they didn't enable it, your videos will play fullscreen despite the attribute being set.
  - tinus_hn 4y ago
    YouTube (the website) plays video in a frame just fine.
- mmazzarolo 4y ago
  The “play” method is enough to trigger the full screen — which, by the way, isn’t really intuitive imho.
  - judge2020 4y ago
    That's only if the video doesn't have the attribute `playsinline`.
influx 4y ago
Did you report this to Apple?
- imbnwa 4y ago
  HN/Tech industry social media part-times as a tracker anyway
- aaaaaaaaaaab 4y ago
  It is well known that reporting anything to Apple is a waste of time.
  - nojito 4y ago
    Based on what exactly? There have been a bunch of reported bugs fixed in the last 24 hours. https://bugs.webkit.org/buglist.cgi?chfield=%5BBug%20creation%5D&chfieldfrom=24h https://bugs.webkit.org/buglist.cgi?chfield=%5BBug%20creatio...
    - saagarjha 4y ago
      Most of those are bugs filed by Apple employees to back the commits they’d like to get merged.
  - sccxy 4y ago
    I agree. Even if they fix it. It will take years to land in new iOS update. Safari cannot update without iOS update...
- mmazzarolo 4y ago
  I did not. I already wasted enough time and energy in the past reporting a security vulnerability in Safari's CSP to know that reporting it is not worth it.
  - Maursault 4y ago
    I couldn't help notice you've exploited your observation in order to promote your blog. There seems to be an awful lot of Apple shaming for self-promotion and entitlement to do so without reciprocating the free attention by taking 5 minutes of your precious time to file a bug report. And I, for one, love how you don't even provide any version information, no iOS version details, no mobile Safari version details. Nothing. Maybe your bug reports are discarded because you fail to provide any salient details. But I think you're absolutely right. A bug report will serve no purpose, because this is definitely not a bug, i.e. not a flaw in code that causes the software to crash or explode. It is instead leveraging a quirk of interface design in order to garner attention for an otherwise unremarkable blog.
happyopossum 4y ago
FWIW, on iOS 16 beta I only get one video window using this sample site - no crazy overlapping anything...
- Operyl 4y ago
  You’ve got a weird config that seems to make it not happen to you then. On a fresh device, stock options, running beta 1 I still see this issue. It’s not nearly as bad as it is in his video demo but it still exists.
- mmazzarolo 4y ago
  That's nice to hear. It really was a bug, then.
theseobosscom 4y ago
I recently experienced almost the same bug, I opened YouTube in a normal tab and was able to play another video in a private tab and both videos played simultaneously.
- mh- 4y ago
  That feels like a bug worth independently filing. I'm not sure what I expected the behavior of a private tab to be, when "backgrounded" in favor of a normal one, but it's not that.
post_break 4y ago
This happens when you browse sites that are "cancer for mobile" when looking at NSFW things. Not that I would know anything about that.
- casefields 4y ago
  Pirated sports streams too sometimes.
- zionic 4y ago
  Web devs have been saying they want to take over the native app experience for 20+ years, and after all this time we’re still stuck with shit like this. Edit: I just opened weather.com on mobile and I rest my case.
- mike10921 4y ago
  Well if these websites were not doing it till now, we now have a great reference explaining how to do so. :)
zagrebian 4y ago
Did anyone file a bug on https://bugs.webkit.org https://bugs.webkit.org?
- mmazzarolo 4y ago
  https://bugs.webkit.org/show_bug.cgi?id=241756 https://bugs.webkit.org/show_bug.cgi?id=241756
hbn 4y ago
I've discovered this while fighting another issue: if you long-press a link to a video file to try and save it to your device (I occasionally do this while ripping videos from Twitter), you get the long-press context menu you want (with the "download linked file" item) for like half a second before the full screen video covers up your whole screen, and when you swipe it away the context menu is gone. You literally have to race the video popup, and sometimes I just have to memorize the location on my phone's screen where the "download linked file" button will appear and have my finger ready over the spot because there's not enough time to scan over all the menu items.
- ehPReth 4y ago
  Glad it's not just me! This has been bugging me for quite a while
  - dutchbrit 4y ago
    Ha, it's been bugging me for a long time too. Frustrating!
    - hbn 4y ago
      Turns out there is a solution! Check the sibling comment: https://news.ycombinator.com/item?id=31770188 https://news.ycombinator.com/item?id=31770188
- reaperducer 4y ago
  if you long-press a link to a video file to try and save it to your device (I occasionally do this while ripping videos from Twitter), you get the long-press context menu you want (with the "download linked file" item) for like half a second before the full screen video covers up your whole screen, and when you swipe it away the context menu is gone. Is it possible that this is related to the iOS link preview feature? When you long-press a link, do you get the full destination page preview? That might explain why the phone renders the page, including the video taking over. Long-press on another page link (like one here on HN), and you have a tiny option at the top-right for "Hide preview," select that. Then try another link that has a take-over video, and see if it no longer does that. If you hate video takeovers more than you like link previews, this might solve your problem.
londons_explore 4y ago
In general browser vendors don't care about DoS bugs like this. If a web page can do something that stops the browser responding or locks it up, the browser vendor won't fix it. They'll just say "well don't visit webpages that do that then".
- saagarjha 4y ago
  This is definitely something browser vendors care about and design around.
the_only_law 4y ago
Yet it interrupts my music when a non-video ad shows.
Crosseye_Jack 4y ago
It happens on the JLCPCB mobile site when opening the order tracker. The tracker has videos accompanying each of of the stages the order goes though. When viewed on the mobile site it just starts playing them all. Or at least it used to. I just started using the desktop site when I need to track my orders, they might have fixed it since.

125 points by mmazzarolo 4y ago

Definitely looks like the kind of bug I'd find exploited on early Internet Explorer. Open a suspicious tab, get spammed with fullscreen ads! Now that's thinking differently.

LesZedCB 4y ago
use it against them so sites can charge for a full ad watch, but they are hidden by the content that people actually want to watch.
Maursault 4y ago
A bug is an error in source code that causes a program to produce unexpected results or crash altogether, i.e. something that doesn't work, something broken; the user initiates an action, the action fails or program crashes. That isn't what this is. This is the user intentionally opening multiple overlapping fullscreen videos. You can make a computer saturate its processor indefinitely with a while-loop, but doesn't make it a bug.
- mmazzarolo 4y ago
  I would still consider a missing safety check (like in this case, to check if there’s already a full screen video open) as a bug.
  - Maursault 4y ago
    And I'd agree, except that this behavior is an advertised feature of the of the system, iow, if you open multiple fullscreen videos, you should expect to see what is seen as opposed to Safari crashing or the system crashing.
    - Thorrez 4y ago
      Where is it advertised?
      - Maursault 4y ago
        Back in 2010 with the release of iOS 4 and it's multitasking feature, and probably also in 2020 with iOS 14's Picture in Picture mode.
        Thorrez 4y ago
        Hmm, is opening a fullscreen video considered opening a new application, or is it considered a single application (the browser) displaying different content? I thought it was the second case, so multitasking I don't think applies. Same for desktop chrome, when it shows a fullscreen video, that's not a new application, just the browser displaying content in a new way. For picture in picture mode, I don't think multiple fullscreen videos should be a valid configuration of picture in picture.
- function_seven 4y ago
  The user isn't the one intentionally opening these overlapping videos. The site they're visiting is making that request, and the browser is honoring it. This is a bug. These are unexpected results! And as the article notes, "sometimes this behavior makes Safari crash." So a website can make your browser crash by getting it to do something nonsensical (opening 30 overlapping full screen videos), without your forewarning that this could happen. You can quibble and say it's a "misfeature" or similar, but I'm not sure that means much.
  - Maursault 4y ago
    > The user isn't the one intentionally opening these overlapping videos. Yes, he absolutely is, and the proof is > So here’s a tiny web page I created to play with it. What OP is reporting is more accurately described as a possible memory overflow exploit. The software appears to be operating as designed, but a malicious attacker might be able to exploit the behavior to do bad things, though this is not exactly necessarily true, and we won't know until we see it happen.
    - jaywalk 4y ago
      The person who created the web page is the user? I think you've got that backwards.
      - stonemetal12 4y ago
        He found a bug and made a proof of concept webpage to demonstrate it. So when he talks about it he is both the user and the author of the web page. In general You wouldn't expect them to be the same person.
    - function_seven 4y ago
      This is weird. Okay, so it may not be a software bug at all, but I'm gonna move these goalposts and insist this is a product design bug, or something. If this is intentional behavior, I don't understand the point. A full-screen video should be the only one playing IMO. Playing multiple (windowed) videos is one thing, but having 30 of them overlap full screen is quite another. And with no affordances to mass-terminate them, the result is unwanted behavior. So: not a bug in the "off-by-one" or "use-after-free" sense, but damn if it ain't a close cousin.
isodev 4y ago
I have a project where this is a legitimate use case. Indeed, Safari was the only browser where it was possible to implement without trickeries… eventually the team managed to get a version for Firefox snd chromiums as well (on desktop too).
- Thorrez 4y ago
  What is the use case?
- smoldesu 4y ago
  What is your legitimate use-case for opening multiple overlapping fullscreen video players?
code_duck 4y ago
The worst experience I’ve had on iOS, fairly recently, was clicking on a search result and being redirected to a dodgy website which displayed a “your phone has a virus!” pop up, started attempting to call a phone number repeatedly, and somehow corrupted the OS to where I saw a distorted version of the left-hand slide menu from the home screen, could not go to the home screen, close the app or reboot. I managed to reboot through a different method but it’s made me very wary of going to random websites on my phone.
- r00fus 4y ago
  I've never had this kind of experience for the past 14 years on iOS. How could a website get access to call numbers without interaction?
  - Operyl 4y ago
    It's spamming the modal asking if you want to call x phone number, probably.
    - code_duck 4y ago
      The corruption of the interface was the most disturbing thing. It was showing the left-hand slide home screen menu offset, overlapping with other elements, without any ability to interact with it. It must be some sort of memory corruption vulnerability, I assume. Apple did an update a week or two later which addressed some sort of zero day… So clearly I was wondering exactly how hacked my phone might have been. I was able to reboot and it has seems OK, but who knows.
      - Operyl 4y ago
        Apple addresses zero days and security related bugs every single update, I wouldn't get paranoid about a visual glitch on its own honestly.
        code_duck 4y ago

sp332 4y ago

Where is the part that causes these videos to be full screen? I didn't see that in the HTML or JS.

mnemnc 4y ago
That‘s at least the default behavior if not the only way to play video on iPhone‘s Safari. iPad Safari however supports non-fullscreen video playback.
- happyopossum 4y ago
  Fullscreen is definitely not the only way to play video on iOS safari...
- GranPC 4y ago
  iOS Safari can play videos non-fullscreen with the playsinline or webkit-playsinline attributes. The fun thing though is that this attribute must be enabled manually on each web view, so if some other app is embedding your page and they didn't enable it, your videos will play fullscreen despite the attribute being set.
- tinus_hn 4y ago
  YouTube (the website) plays video in a frame just fine.
mmazzarolo 4y ago
The “play” method is enough to trigger the full screen — which, by the way, isn’t really intuitive imho.
- judge2020 4y ago
  That's only if the video doesn't have the attribute `playsinline`.

influx 4y ago

Did you report this to Apple?

imbnwa 4y ago
HN/Tech industry social media part-times as a tracker anyway
aaaaaaaaaaab 4y ago
It is well known that reporting anything to Apple is a waste of time.
- nojito 4y ago
  Based on what exactly? There have been a bunch of reported bugs fixed in the last 24 hours. https://bugs.webkit.org/buglist.cgi?chfield=%5BBug%20creation%5D&chfieldfrom=24h https://bugs.webkit.org/buglist.cgi?chfield=%5BBug%20creatio...
  - saagarjha 4y ago
    Most of those are bugs filed by Apple employees to back the commits they’d like to get merged.
- sccxy 4y ago
  I agree. Even if they fix it. It will take years to land in new iOS update. Safari cannot update without iOS update...
mmazzarolo 4y ago
I did not. I already wasted enough time and energy in the past reporting a security vulnerability in Safari's CSP to know that reporting it is not worth it.
- Maursault 4y ago
  I couldn't help notice you've exploited your observation in order to promote your blog. There seems to be an awful lot of Apple shaming for self-promotion and entitlement to do so without reciprocating the free attention by taking 5 minutes of your precious time to file a bug report. And I, for one, love how you don't even provide any version information, no iOS version details, no mobile Safari version details. Nothing. Maybe your bug reports are discarded because you fail to provide any salient details. But I think you're absolutely right. A bug report will serve no purpose, because this is definitely not a bug, i.e. not a flaw in code that causes the software to crash or explode. It is instead leveraging a quirk of interface design in order to garner attention for an otherwise unremarkable blog.

happyopossum 4y ago

FWIW, on iOS 16 beta I only get one video window using this sample site - no crazy overlapping anything...

Operyl 4y ago
You’ve got a weird config that seems to make it not happen to you then. On a fresh device, stock options, running beta 1 I still see this issue. It’s not nearly as bad as it is in his video demo but it still exists.
mmazzarolo 4y ago
That's nice to hear. It really was a bug, then.

theseobosscom 4y ago

I recently experienced almost the same bug, I opened YouTube in a normal tab and was able to play another video in a private tab and both videos played simultaneously.

mh- 4y ago
That feels like a bug worth independently filing. I'm not sure what I expected the behavior of a private tab to be, when "backgrounded" in favor of a normal one, but it's not that.

post_break 4y ago

This happens when you browse sites that are "cancer for mobile" when looking at NSFW things. Not that I would know anything about that.

casefields 4y ago
Pirated sports streams too sometimes.
zionic 4y ago
Web devs have been saying they want to take over the native app experience for 20+ years, and after all this time we’re still stuck with shit like this. Edit: I just opened weather.com on mobile and I rest my case.
mike10921 4y ago
Well if these websites were not doing it till now, we now have a great reference explaining how to do so. :)

zagrebian 4y ago

Did anyone file a bug on https://bugs.webkit.org https://bugs.webkit.org?

mmazzarolo 4y ago
https://bugs.webkit.org/show_bug.cgi?id=241756 https://bugs.webkit.org/show_bug.cgi?id=241756

hbn 4y ago

I've discovered this while fighting another issue: if you long-press a link to a video file to try and save it to your device (I occasionally do this while ripping videos from Twitter), you get the long-press context menu you want (with the "download linked file" item) for like half a second before the full screen video covers up your whole screen, and when you swipe it away the context menu is gone. You literally have to race the video popup, and sometimes I just have to memorize the location on my phone's screen where the "download linked file" button will appear and have my finger ready over the spot because there's not enough time to scan over all the menu items.

ehPReth 4y ago
Glad it's not just me! This has been bugging me for quite a while
- dutchbrit 4y ago
  Ha, it's been bugging me for a long time too. Frustrating!
  - hbn 4y ago
    Turns out there is a solution! Check the sibling comment: https://news.ycombinator.com/item?id=31770188 https://news.ycombinator.com/item?id=31770188
reaperducer 4y ago
if you long-press a link to a video file to try and save it to your device (I occasionally do this while ripping videos from Twitter), you get the long-press context menu you want (with the "download linked file" item) for like half a second before the full screen video covers up your whole screen, and when you swipe it away the context menu is gone. Is it possible that this is related to the iOS link preview feature? When you long-press a link, do you get the full destination page preview? That might explain why the phone renders the page, including the video taking over. Long-press on another page link (like one here on HN), and you have a tiny option at the top-right for "Hide preview," select that. Then try another link that has a take-over video, and see if it no longer does that. If you hate video takeovers more than you like link previews, this might solve your problem.

londons_explore 4y ago

In general browser vendors don't care about DoS bugs like this. If a web page can do something that stops the browser responding or locks it up, the browser vendor won't fix it. They'll just say "well don't visit webpages that do that then".

saagarjha 4y ago
This is definitely something browser vendors care about and design around.

the_only_law 4y ago

Yet it interrupts my music when a non-video ad shows.

Crosseye_Jack 4y ago

It happens on the JLCPCB mobile site when opening the order tracker. The tracker has videos accompanying each of of the stages the order goes though. When viewed on the mobile site it just starts playing them all. Or at least it used to. I just started using the desktop site when I need to track my orders, they might have fixed it since.