1924373 - Navigation Using beforeunload and document.open

Status: RESOLVED INVALID

(Core :: DOM: Navigation, defect)

Description

[Kang Ali]

Attachment: repro.mov

VULNERABILITY DETAILS

Handling of navigation and redirection triggered by the beforeunload event. This vulnerability allows an attacker to prevent users from returning to the previous page and redirect them to a phising site without their knowledge.

beforeunload event signaling to the browser that the user is attempting to leave page.After alert is displayed, the user will be redirected to a different site. However, the actual navigation is handled with document.open(), which replaces current content and does not save navigation history in browser.
When users are redirected, they cannot return to their previous site using back button in the browser, thereby increasing the risk of phishing.

VERSION

OS : macOs Monterey
Firefox Nightly : 133.0a1 (2024-10-13) (64-bit)

REPRODUCTION CASE

1. Open before.html
2. Click "Activate" button
3. After 3 seconds, the user will see an alert and be redirected

Comment 1

[Kang Ali]

Attachment: before.html

Comment 2

[Andrew McCreight [:mccr8]]

The navigation does not involve window.open, and there's no real beforeunload event, so it is basically just calling a method directly, so this doesn't really make sense and doesn't seem like an issue. Basically this is just the same as calling window.location.replace("http://127.0.0.1:8883/phising/");.