New API to control document.location & manage internal popup component
Reported by
labobol...@gmail.com,
Aug 18 2017
|
||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36 Steps to reproduce the problem: 1. Go to a site with nasty ads & popups. It detects that you are running Chrome and goes straight to document.location and popunder, etc. document.location abuse: First it opens the current url in a new tab then it use document.location to change the current tab to some even more nasty site that tries to trick you into installing a chrome extension, etc, etc. Extension developers need control over document.location to better secure and prevent this since honestly, from my perspective, you don't seem to do anything about it at all. Popups not blocked by chrome and extension devs are powerless. ---- Managed to find some mild NSFW examples. (The easiest way to find examples of the above). document.location abuse example: https://www.redtube.com/ 1. Click on a video. Popup example: http://celebgate.ws/2017/08/05/asmr-is-awesome-nude/ 1. Click one of the play buttons to get popups. (Want more popups? Wait a little while and click on the site and another popup shows up). What is the expected behavior? That chrome prevents such behavior or gives the user the option to have a whitelist/black list to prevent redirects or enable extension devs to do the mentioned stuff. What went wrong? Chrome doesn't block it, not even the nasty popups from popunder and such. User have no options. Extension devs can't do anything because the API doesn't exist. Did this work before? No Chrome version: 60.0.3112.101 Channel: stable OS Version: 6.1 (Windows 7, Windows Server 2008 R2) Flash Version: Firefox got: 1. NoRedirect to control redirects of all kinds. 2. Adblock Plus can actually prevent popups in Firefox because Firefox doesn't hinder in any way. Add-on devs have full power. Connect the computer to the kitchen stove and I'm sure add-on devs could write something that could even boil an egg for you through Firefox. I'm sure you get my point. Apologies for choosing "Security". That was the closest one that matched this issue.
,
Aug 21 2017
As this is a feature request , marking it as untraiged , so that it would get addressed by respective team. Thanks!
,
Aug 25 2017
labobolink@: Do you have any ideas on how to make the existing APIs like webrequest better to support the use case to point out. |
||
►
Sign in to add a comment |
||
Comment 1 by elawrence@chromium.org
, Aug 18 2017Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Feature