1354168 - Maximum number of allowed pop-ups can be bypassed

Status: RESOLVED DUPLICATE of bug 675574

(Firefox :: Untriaged, defect)

Description

[Marcus Niemietz]

Attachment: Proof of concept (three files)

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20170323105023

Steps to reproduce:

The victim has to call JavaScript via a trusted event like a click on a button to show pop-up windows.


Actual results:

In case of a trusted event (e.g., click), we are able to open an arbitrary number of pop-up windows. Though "dom.popup_maximum" (about:config) has a maximum number of 20 pop-up windows, we can for example create 100 pop-up windows and thus flood the browser with an arbitrary number of windows.


Expected results:

There should be only allowed the defined number (20) of windows.

Comment 1

[Marcus Niemietz]

Please note that this could be used by the advertisement industry to bypass the pop-up blocker behavior. Furthermore, an attacker could simply annoy the user (long wait times until the browser responds/ many windows) by flooding his browser with windows (with pop-ups or tabs).

Comment 2

[Daniel Veditz [:dveditz]]

I'm pretty sure we have a dupe on this