MetaMask / MetaMask/metamask-mobile
[Bug]: HTTP protocol is shown as secure like HTTPS with a padlock mark in DApp on MetaMask Android
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 1.7k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 669
Description
### Describe the bug
This vulnerability occurs when a MetaMask DApp on Android does not implement secure address bar design principles, causing HTTP to be displayed as secure andsimilar to HTTPS protocol with a padlock. On iOS, HTTP sites cannot be accessed, but on Android they can. Even worse, the HTTP protocol is shown with a padlock icon in the address bar, misleading users into thinking the connection is secure
### Expected behavior
MetaMask Android DApp should mark HTTP protocol sites as insecure with a warning symbol, or simply prevent the DApp from accessing HTTP sites.
### Screenshots/Recordings
https://github.com/user-attachments/assets/33822bca-63fc-4d33-bdc7-589da4467c70
### Steps to reproduce
Just simply access http://httpforever.com/ on MetaMask Android DApp and you'll see the address bar mark the HTTP protocol sites same as HTTPS, with a padlock icon mark.
### Error messages or log output
```shell
```
### Detection stage
In production (default)
### Version
7.56.5
### Build type
None
### Device
Samsung A56 with Latest OS Version
### Operating system
Android
### Additional context
Actually, I reported this vulnerability on HackerOne as a security issue. However, I’m not sure why the H1 analyst closed my report as informative. I would like the MetaMask team to take a closer look at this issue, as I believe it could be considered a high severity security problem. I’m also reporting it here on GitHub because, as a daily active MetaMask user, I want to see this issue fixed. But, if you have time, please review my report on HackerOne again :)
https://hackerone.com/reports/3359657
### Severity
_No response_
Contributor guide
Research direction
Reproduce the behavior by opening http://httpforever.com/ in the MetaMask Android DApp browser and compare its address-bar indicator with an HTTPS site. Trace the address-bar protocol handling and verify that HTTP is shown as insecure or blocked while HTTPS retains its secure indicator.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, react-native, typescript
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100