Popup blocker doesn't prevent endless flood of popups
Reported by
iamsagit...@gmail.com,
May 18 2018
|
||||
Issue description<b>Chrome Version : <Copy from: 'about:version'></b> URLs (if applicable) : https://codepen.io/IamSagittare/pen/rvoOeB (location to find the script used) Other browsers tested: Add OK or FAIL after other browsers where you have tested this issue: Safari:OK Firefox:FAIL IE/Edge:OK What steps will reproduce the problem? 1. Run the script with popups NOT blocked What is the expected result? XSS prevention blocks opened tabs from opening more tabs. What happens instead of that? Endless tabs open in Chrome. Please provide any additional information below. Attach a screenshot if possible. The code does not run in Edge, it gets blocked. In FireFox it opens about 30 tabs and then cancels the script. In Chrome the script does not run if popups are blocked. If the "button" (which is supposed to only activate if clicked) is removed from the script, the opened tabs do not open more tabs. The script is attached in a RAR file for convenience.
,
May 22 2018
+tsepez@ for XSS Auditor.
,
May 22 2018
Able to reproduce the issue on chrome stable# 66.0.3359.181 and on latest chrome# 68.0.3436.0 using Windows-10, Ubuntu 14.04 and Mac 10.12.6. As the issue is seen from M-60(60.0.3112.0), hence considering this as Non-Regression issue. Thanks!
,
May 22 2018
This repro has nothing to do with XSS. It simply notes that a new window, if allowed, can itself create a new window if the original window simulates a click in the new window. I'm pretty sure this has been filed before. |
||||
►
Sign in to add a comment |
||||
Comment 1 by rsleevi@chromium.org
, May 21 2018Components: UI>Browser>PopupBlocker Blink>SecurityFeature>XSSAuditor