Fix This Critical Fullscreen Security Issue in Aloha Browser for iPad

In Progress Delly

Hello. I’ve been using Aloha Browser for quite some time, and I recently noticed a security issue that I believe needs your attention.

When a website enters fullscreen mode, the browser’s address bar disappears completely. There is no persistent fullscreen notification or trusted browser indicator to help users confirm which website they are actually visiting.

https://chromium.googlesource.com/chromium/src/+/main/docs/security/fullscreen.md/block blast

This creates a potential address bar spoofing vulnerability. A malicious website could imitate the browser’s address bar and display a trusted domain, such as google.com, even though the actual content comes from a completely different and potentially dangerous origin.

The problem is particularly concerning because users may believe they are interacting with a legitimate website when they are actually viewing a deceptive page. Without a reliable visual indicator, it becomes difficult to distinguish genuine browser UI from elements created by the website itself.

I understand that fullscreen mode is useful for watching videos and viewing content without distractions. However, hiding all trusted browser indicators without providing a persistent notification can introduce unnecessary security risks.

Please consider implementing the following improvements:

• Display a persistent notification whenever a website enters fullscreen mode.
• Provide a trusted browser indicator in security-sensitive situations.
• Prevent fullscreen web content from convincingly imitating the browser’s genuine address bar.

These safeguards would help users identify suspicious websites and reduce the risk of phishing attacks. Since Chromium has already documented this fullscreen security concern, I hope the Aloha team will consider adopting appropriate mitigations.

Please investigate this issue and let users know whether a fix is planned. Thank you!