MetaMask / MetaMask/metamask-mobile

[Bug]: HTTP protocol is shown as secure like HTTPS with a padlock mark in DApp on MetaMask Android

Open
#21,217 0 comments 0 reactions 0 assignees View on GitHub
external-contributor regression-prod-7.56.5 Sev2-normal team-wallet-standard type-bug
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

### Describe the bug

This vulnerability occurs when a MetaMask DApp on Android does not implement secure address bar design principles, causing HTTP to be displayed as secure andsimilar to HTTPS protocol with a padlock. On iOS, HTTP sites cannot be accessed, but on Android they can. Even worse, the HTTP protocol is shown with a padlock icon in the address bar, misleading users into thinking the connection is secure

### Expected behavior

MetaMask Android DApp should mark HTTP protocol sites as insecure with a warning symbol, or simply prevent the DApp from accessing HTTP sites.

### Screenshots/Recordings

https://github.com/user-attachments/assets/33822bca-63fc-4d33-bdc7-589da4467c70

### Steps to reproduce

Just simply access http://httpforever.com/ on MetaMask Android DApp and you'll see the address bar mark the HTTP protocol sites same as HTTPS, with a padlock icon mark.

### Error messages or log output

```shell

```

### Detection stage

In production (default)

### Version

7.56.5

### Build type

None

### Device

Samsung A56 with Latest OS Version

### Operating system

Android

### Additional context

Actually, I reported this vulnerability on HackerOne as a security issue. However, I’m not sure why the H1 analyst closed my report as informative. I would like the MetaMask team to take a closer look at this issue, as I believe it could be considered a high severity security problem. I’m also reporting it here on GitHub because, as a daily active MetaMask user, I want to see this issue fixed. But, if you have time, please review my report on HackerOne again :)

https://hackerone.com/reports/3359657
Image

Image

### Severity

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the behavior by opening http://httpforever.com/ in the MetaMask Android DApp browser and compare its address-bar indicator with an HTTPS site. Trace the address-bar protocol handling and verify that HTTP is shown as insecure or blocked while HTTPS retains its secure indicator.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, react-native, typescript
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.