Allow Window Close During Javascript Alerts
Reported by
miqrogro...@gmail.com,
Dec 11 2016
|
||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.75 Safari/537.36 Steps to reproduce the problem: 1. Trigger a Javscript Alert 2. Attempt to close Chrome. What is the expected behavior? It needs to be possible to close the browser at all times for security and privacy. What went wrong? The UI historically makes this impossible. Did this work before? No Chrome version: 55.0.2883.75 Channel: stable OS Version: 10.0 Flash Version: Shockwave Flash 23.0 r0 My family was recently victimized in a "Your computer has a virus" website scam. In reviewing what happened, I found the key problem was that the user did not know how and could not find a way to close Chrome during a Javascript alert. In brief, the checkbox to prevent additional alerts is inadequate. I call upon the Chromium community to disrupt this terrible feature of the UI, and to permanently and consistently allow the application to close at any time by clicking the window's "X" button.
,
Dec 12 2016
,
Dec 12 2016
miqrogroove: Thanks for the report.Tried to reproduce the issue on win 10 using 55.0.2883.75 and below are my observations. 1) Unable to close Chrome without closing the alert window by clicking on Close button and unable click on wrench button. 2) Was able to close the alert by the close button on alert window as well by pressing Alt+F4. Could you please confirm on it if the issue is point 1.
,
Dec 12 2016
Corecting the Version above, its latest stable 55.0.2883.87.
,
Dec 12 2016
Durga, 1) This is correct. 2) On the scam websites, this does not work because a new alert is generated immediately upon closing the alert.
,
Dec 12 2016
,
Dec 15 2016
I just found a website where after clicking the checkbox to block additional Javascript alerts, the page loads a fake dialog box with the same checkbox. Clicking the fake checkbox switches the browser to fullscreen mode and prompts the user to install an extension. Pressing the Esc key brings the user back to the fake dialog box, creating the appearance of an inescapable loop. The catch is, if the user was smart enough to click the checkbox, it is later possible to close the browser after that step.
,
Dec 19 2016
Issue 675324 has been merged into this issue.
,
Dec 23 2016
I am running into more and more of these hacked sites every day. Disabling Javascript is a difficult but effective workaround. Is there any way to expedite this issue or is it going to be a problem for a long time still?
,
Jan 2 2017
Thank you for providing more feedback. Adding requester "durga.behera@chromium.org" for another review and adding "Needs-Review" label for tracking. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 3 2017
+Jochen, who is interested in popup blocking and deprecating modal dialogs.
,
Jan 3 2017
,
Jan 3 2017
Looks like a duplicate of issue 456 .
,
Jan 3 2017
It might be a duplicate. However, I am trying to highlight some differences: * There are new and prevalent attacks that spoof the entire alert window and extensions manager by using full screen mode and other tricks. * Making the alerts modal to a tab is not a solution. Alerts need to be rate restricted or limited to one-time-only, relocated to a sidebar, or completely eliminated. Instead of the useless "OK" button, there must be a "Stop" or equivalent single-click action to prevent alerts of this type. * Issue 456 is 8 years old, appears to be targeted toward vague personal preferences, and with no traction.
,
Jan 3 2017
This is something that is implemented in M56 and that I am working on shipping.
,
Jan 3 2017
Also, about preventing alerts, they are very very heavily used on the web and we can't just eliminate them, or else we'll break the web. We need to go slowly and deliberately. Being able to close the tab running an alert is just the first step. There is more that I'm planning.
,
Jan 4 2017
Break the web? I've never seen a website that would break if the alerts were removed. But if it makes someone feel better, it could be a setting instead of a forced change.
,
Jan 4 2017
We tend to not do settings in Chrome. As for breaking the web, I could give you links to bugs where people have... um... freaked out at the thought that we might remove dialogs. Yes, lots of websites use them (we have the numbers) and we can't remove them yet. I am planning to ratchet down their power. I have hopes that maybe someday we can remove them, but that's not going to happen any time soon :( Thank you for being on the side of change, though.
,
Jan 6 2017
It's not just about change. This is becoming an extremely urgent problem. I know first hand it is affecting everyone in my family. Just this morning I was looking over the shoulder of a family member who was trying to close one of these fraudulent websites with auto-play audio, persistent Javascript alerts, and attempts to collect payment. This needs to be fixed NOW. |
||||||||
►
Sign in to add a comment |
||||||||
Comment 1 by ajha@chromium.org
, Dec 12 2016