JavaScript dialogs' activation behavior enables abuse |
|||||||||||
Issue descriptionA popup to callfortechsupport.xyz appeared today and the site found a way to ensure it is continually refocused whenever I tried to swap windows or do anything else. Probably worth investigating what they're doing and how to prevent it in the future! ccing Emily and Adrienne for triage
,
Jun 26 2017
avi@ has been looking at similar issues for dialogs. Maybe he can take a look? (Also CC'ing alexmos@ for focus knowledge.) owencm@: Do you have a URL for repro'ing the popup creation?
,
Jun 26 2017
This site first pops up an httpauth dialog (not sure why) and then repeatedly shows a window.alert() dialog. That dialog, when displayed, automatically activates the tab showing it, so even if you switch away to a different tab, you return to this one. You can close the tab of the abusive website, so that is the recommended way out. I want to remove the ability for a website to activate itself using window.alert() and window.confirm() dialogs. I haven't started because I anticipate this will be a difficult Intent to push through, but I'm running out of projects I'm currently working on so this one might be next.
,
Jun 26 2017
,
Jun 26 2017
I'm attaching a screencap movie showing the abuse. I don't have audio, but when this page is open it reads in a synthesized voice how my computer is infected and this was detected by Microsoft, etc. But this just got extremely nasty. It forced itself into fullscreen, and I don't think I'm running the version of Chrome that kicks things out of fullscreen with the alert, so I was stuck in fullscreen because the escape key didn't work with the alerts. Finally I somehow ended up with a window that wasn't in system fullscreen but a full-screen sized window. The app-modal dialog that I used didn't allow me to click out and the dialog was covering the tabstrip. I think it somehow breaks fullscreen on the Mac and jams things up. I was forced to kill and restart Chrome. The new protections for dropping fullscreen should help here, and we really need to kill dialog activation, but it's not clear exactly what happened.
,
Jun 27 2017
,
Jul 6 2017
[MacTriage]
,
Jul 12 2017
-me, +estark
,
Jun 8 2018
Dialogs no longer activate. Follow up if this is still a concern. |
|||||||||||
►
Sign in to add a comment |
|||||||||||
Comment 1 by emilyschechter@chromium.org
, Jun 26 2017