1589724 - Trivial back button hijacking using History API fools Firefox, but not Chrome.

Status: RESOLVED DUPLICATE of bug 1515073

(Core :: DOM: Navigation, defect)

Description

[Thomas Wisniewski [:twisniewski]]

The following script fragment works in Firefox to lock the user into being unable to use the back button without long-tapping/right-clicking it to get past the abuse, which is unfortunately impossible right now in Firefox Preview, so users are stuck:

  history.pushState(null, null, document.URL)
  window.addEventListener("popstate", function() {
    history.pushState(null, null, document.URL)
    location.reload()
});

Chrome is not affected by this; it seems to ignore the initial pushState, and not add it as a separate history entry.

Comment 1

[Karl Dubost💡 :karlcow]

Thomas, would it be similar to this bug
Bug 1580072

Comment 2

[Karl Dubost💡 :karlcow]

Some issue that might have been related.
https://github.com/webcompat/web-bugs/issues/23283