New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 673166 link

Starred by 5 users

Issue metadata

Status: Duplicate
Merged: issue 629964
Owner:
Last visit > 30 days ago
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows , All
Pri: 2
Type: Bug



Sign in to add a comment

Allow Window Close During Javascript Alerts

Reported by miqrogro...@gmail.com, Dec 11 2016

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.75 Safari/537.36

Steps to reproduce the problem:
1. Trigger a Javscript Alert
2. Attempt to close Chrome.

What is the expected behavior?
It needs to be possible to close the browser at all times for security and privacy.

What went wrong?
The UI historically makes this impossible.

Did this work before? No 

Chrome version: 55.0.2883.75  Channel: stable
OS Version: 10.0
Flash Version: Shockwave Flash 23.0 r0

My family was recently victimized in a "Your computer has a virus" website scam.  In reviewing what happened, I found the key problem was that the user did not know how and could not find a way to close Chrome during a Javascript alert.

In brief, the checkbox to prevent additional alerts is inadequate.

I call upon the Chromium community to disrupt this terrible feature of the UI, and to permanently and consistently allow the application to close at any time by clicking the window's "X" button.
 

Comment 1 by ajha@chromium.org, Dec 12 2016

Labels: M-55
Components: -UI Blink>WindowDialog
Labels: prestable-55.0.2883.75 OS-All
Cc: durga.behera@chromium.org
Labels: Needs-Feedback
miqrogroove: Thanks for the report.Tried to reproduce the issue on win 10 using 55.0.2883.75 and below are my observations.
1) Unable to close Chrome without closing the alert window by clicking on Close button and unable click on wrench button.
2) Was able to close the alert by the close button on alert window as well by pressing Alt+F4.
Could you please confirm on it if the issue is point 1.
673166_Dec_12.mp4
475 KB View Download
Corecting the Version above, its latest stable 55.0.2883.87.
Durga, 
1) This is correct.
2) On the scam websites, this does not work because a new alert is generated immediately upon closing the alert.

Comment 6 by kolos@chromium.org, Dec 12 2016

Components: Privacy
I just found a website where after clicking the checkbox to block additional Javascript alerts, the page loads a fake dialog box with the same checkbox.  Clicking the fake checkbox switches the browser to fullscreen mode and prompts the user to install an extension.  Pressing the Esc key brings the user back to the fake dialog box, creating the appearance of an inescapable loop.  The catch is, if the user was smart enough to click the checkbox, it is later possible to close the browser after that step.
 Issue 675324  has been merged into this issue.
I am running into more and more of these hacked sites every day.  Disabling Javascript is a difficult but effective workaround.

Is there any way to expedite this issue or is it going to be a problem for a long time still?
Project Member

Comment 10 by sheriffbot@chromium.org, Jan 2 2017

Labels: -Needs-Feedback Needs-Review
Owner: durga.behera@chromium.org
Thank you for providing more feedback. Adding requester "durga.behera@chromium.org" for another review and adding "Needs-Review" label for tracking.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: jochen@chromium.org
+Jochen, who is interested in popup blocking and deprecating modal dialogs.
Cc: a...@chromium.org

Comment 13 by woxxom@gmail.com, Jan 3 2017

Looks like a duplicate of  issue 456 .
It might be a duplicate.  However, I am trying to highlight some differences:

* There are new and prevalent attacks that spoof the entire alert window and extensions manager by using full screen mode and other tricks.

* Making the alerts modal to a tab is not a solution.  Alerts need to be rate restricted or limited to one-time-only, relocated to a sidebar, or completely eliminated.  Instead of the useless "OK" button, there must be a "Stop" or equivalent single-click action to prevent alerts of this type.

*  Issue 456  is 8 years old, appears to be targeted toward vague personal preferences, and with no traction.

Comment 15 by a...@chromium.org, Jan 3 2017

Mergedinto: 629964
Status: Duplicate (was: Unconfirmed)
This is something that is implemented in M56 and that I am working on shipping.

Comment 16 by a...@chromium.org, Jan 3 2017

Also, about preventing alerts, they are very very heavily used on the web and we can't just eliminate them, or else we'll break the web. We need to go slowly and deliberately. Being able to close the tab running an alert is just the first step. There is more that I'm planning.
Break the web?  I've never seen a website that would break if the alerts were removed.  But if it makes someone feel better, it could be a setting instead of a forced change.

Comment 18 by a...@chromium.org, Jan 4 2017

We tend to not do settings in Chrome.

As for breaking the web, I could give you links to bugs where people have... um... freaked out at the thought that we might remove dialogs. Yes, lots of websites use them (we have the numbers) and we can't remove them yet.

I am planning to ratchet down their power. I have hopes that maybe someday we can remove them, but that's not going to happen any time soon :(

Thank you for being on the side of change, though.
It's not just about change.  This is becoming an extremely urgent problem.  I know first hand it is affecting everyone in my family.  Just this morning I was looking over the shoulder of a family member who was trying to close one of these fraudulent websites with auto-play audio, persistent Javascript alerts, and attempts to collect payment.  This needs to be fixed NOW.

Sign in to add a comment