Created attachment 8555897 [details] Extension that shows the problem I'm demoing this using alerts, but it's happening for us with login dialogs, so it's a real world issue. If you display an alert and then subsequently display a separate alert in response to an async XMLHttpRequest, after dismissing the second alert, the first alert becomes modeless, allowing full access to the browser window behind it. It should stay modal. The attached extension displays the problem immediately upon installation. You'll want to uninstall after testing, otherwise it will show the alerts at startup.