Incident Response from BlackBerry Cybersecurity Services

Export Control - ITAR Compliance - Export Administration Regulation

Secure Phone App – BlackBerry SecuSUITE

Secure Instant Messaging and Conferencing – BBM Enterprise

BlackBerry Radar — Asset Tracking

Chassis Tracking — BlackBerry Radar

VPN Alternative

Devices — BlackBerry Radar Asset Tracking

BlackBerry Unified Endpoint Management (UEM)

Cargo & Trailer Tracking — BlackBerry Radar

All controls on the page - including links, buttons, and fields - should show when 
they have been selected by the keyboard.

You can confirm this yourself by loading a webpage and using the Tab key to navigate 
through it. Anything you can select should alter its appearance when selected. 
For example, a text field might change color, or have a distinctive border applied. 

This is default behavior for all standard web controls, and so if this issue is appearing
it is because this default behavior has been disabled. Or alternatively, if you have written
your own custom controls, these will need styling to support focus states.

## How to fix

Links and form controls typically define an `outline` CSS style, which ensures
they are highlighted automatically, for example:

```css
input:focus (outline: 2px solid red);
``` 

If you choose to override or disable the default `outline`, you should specify an accessible 
alternative, such as a border or background color.

### Elements appear to change in the browser

Focus states should be defined in CSS alone, and not require JavaScript to work.

Try disabling JavaScript on the page, and see if focus is still visible. If it not,
then the focus state won't work with assistive technologies that don't have a physical
keyboard, e.g. mobile phones.

Some more unusual means of implementing a focus state cannot be detected or measured
automatically. These include:

* Focus implemented via pseudo-elements - such as `::after` or `::before`.
* Focus using `:focus-within` (JavaScript current provides no way to access these).
* Focus cascaded to child elements, e.g. a `<span>` inside an `<a>` tag. We detect
  some of these cases, but there are variations that we cannot detect.

Currently, there is no practical way to assess these focus states automatically.

### Unexpected elements are focusable

You may be surprised to see tags like `<div>` or `<span>` being shown as focusable.
If an element has a `tabindex` of 0 or higher, it becomes focusable. Any HTML tag can be made 
focusable in this way, this is so that custom controls (e.g. your own drop-down menus, or 
sliders) can support keyboard navigation. [Learn more about tabindex on MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/tabindex).

## Further reading

* [WCAG 2.4.7](https://www.w3.org/WAI/WCAG22/Understanding/focus-visible.html)

ensure-focus-is-visible

November 2024

October 2024

BlackBerry Limited

Title / URL	Issues
Incident Response from BlackBerry Cybersecurity Serviceswww.blackberry.com/us/en/services/incident-response	12
Export Control - ITAR Compliance - Export Administration Regulationwww.blackberry.com/us/en/solutions/export-control	9
Secure Phone App – BlackBerry SecuSUITEwww.blackberry.com/us/en/products/secusuite	5
Secure Instant Messaging and Conferencing – BBM Enterprisewww.blackberry.com/us/en/products/bbm-enterprise	5
BlackBerry Radar — Asset Trackingwww.blackberry.com/us/en/products/asset-tracking	2
Chassis Tracking — BlackBerry Radarwww.blackberry.com/us/en/products/asset-tracking/chassis	1
VPN Alternativewww.blackberry.com/us/en/solutions/vpn-alternative	1
Devices — BlackBerry Radar Asset Trackingwww.blackberry.com/us/en/products/asset-tracking/devices	1
BlackBerry Unified Endpoint Management (UEM)www.blackberry.com/us/en/products/blackberry-uem	1
Cargo & Trailer Tracking — BlackBerry Radarwww.blackberry.com/us/en/products/asset-tracking/trailers	1

Ensure controls change appearance when they are selected

BlackBerry Limited

Where this issue has occurred