1970715 - JavaScript alert() and confirm() steal the mouse pointer and focus from other applications

Status: UNCONFIRMED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Vincent Lefevre]

Under Linux, when a web page in an active tab does an alert() or confirm() while the mouse pointer is over some other application, the mouse pointer is moved to the top-left point of the Firefox window. At least with focus-follows-mouse (as with the FVWM window manager), this has the effect to steal the focus from the window of this other application.

To reproduce:

1. Type in the address bar:
   data:text/html,<script>setTimeout(`alert()`,5000)</script>
   or
   data:text/html,<script>setTimeout(`confirm()`,5000)</script>
2. Move the mouse pointer over the window of another application.
3. Wait for the 5 seconds to timeout.

Result: An alert box is displayed in the Firefox window (which is correct), but the mouse pointer is also moved to the top-left point of the Firefox window.

This behavior is very bad as this may occur while the user was typing text or using the mouse in the other application.

This issue does not occur if a mouse button was pressed during the timeout or if the alert occurs in a background tab.

Comment 1

[Vincent Lefevre]

BTW, if the user was typing text, the characters will be sent to Firefox, and I'm wondering whether the website can capture them. It is also possible that the user was about to type a key combination for the application, which may be destructive in Firefox (e.g. Ctrl-W will close the tab, and Ctrl-R will reload it, with the possibility of losing data).

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Address Bar' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Vincent Lefevre]

The issue actually occurs also with background tabs, which is particularly annoying when some website triggers an alert every few minutes.

Comment 4

[Vincent Lefevre]

The Bugbug bot reassigned this bug to the 'Firefox::Address Bar' component, but I don't see how this could be correct. According to already reported bugs about focus stealing, this could be Core / "DOM: UI Events & Focus Handling" (I could not find anything about the issue with the mouse pointer).

Comment 5

[Negritas Sergiu, Desktop QA]

Hello! I have tried to reproduce the issue with firefox 141.0a1(2025-06-11) on Ubuntu 22.04, Unfortunately I wasn't able to reproduce the issue on my end.
Could you please answer the following questions in order to further investigate this issue?

1. Does this issue happen with a new profile? Here is a link on how to create one: https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles
2. Could you please attach a screen recording of the issue?
3. Do you have any addons installed? If yes could you please list them?

Comment 6

[Vincent Lefevre]

Attachment: Screen recording

Hi,

Yes, the issue is reproducible with a new profile. It is also reproducible with Nightly 141.0a1 (2025-06-10) (64-bit). No addons in these cases.

I've attached a screen recording, using Nightly with a new profile.

Comment 7

[Vincent Lefevre]

I've run Firefox under xtrace, and it seems that this corresponds to the following messages:

26.464 002:<:137f: 60: Request(18): ChangeProperty mode=Replace(0x00) window=0x03800030 property=0x23("WM_HINTS") type=0x23("WM_HINTS") data=0x00000167,0x00000001,0x00000001,0x03800034,0x00000000,0x00000000,0x00000000,0x0380003b,0x03800001;
26.464 002:>:137f: Event PropertyNotify(28) window=0x03800030 atom=0x23("WM_HINTS") time=0x01ebf584 state=NewValue(0x00)
26.464 002:>:137f: Event (generated) ClientMessage(33) format=0x20 window=0x03800030 type=0x175("WM_PROTOCOLS") data=0x76,0x01,0x00,0x00,0x84,0xf5,0xeb,0x01,0x60,0x6d,0x2c,0x79,0x20,0x9e,0x08,0x46,0xc2,0xd9,0xc3,0x01;
26.465 002:>:137f: Event Generic(35) XInputExtension(131) FocusIn(9) deviceid=0x03 time=0x01ebf585 sourceid=0x03 mode=Normal(0x00) detail=Nonlinear(0x03) root=0x0000054e event=0x03800030 child=0x00000000 root_x=959.000000 root_y=861.000000 event_x=-569.000000 event_y=236.000000 same_screen=true(0x01) focus=false(0x00) mods={base_mods=0x00000000 latched_mods=0x00000000 locked_mods=0x00000000 effective_mods=0x00000000}; group={base_group=0x00 latched_group=0x00 locked_group=0x00 effective_group=0x00}; masks=0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000,0x00000000;
26.467 002:>:137f: Event PropertyNotify(28) window=0x0000054e atom=0x178("_NET_ACTIVE_WINDOW") time=0x01ebf587 state=NewValue(0x00)
26.467 002:>:137f: Event (generated) ClientMessage(33) format=0x20 window=0x03800030 type=0x175("WM_PROTOCOLS") data=0x76,0x01,0x00,0x00,0x85,0xf5,0xeb,0x01,0xc3,0x06,0x00,0x00,0x1c,0x00,0x00,0x00,0x3c,0x00,0x00,0x00;
26.467 002:<:1380: 12: Request(42): SetInputFocus revert-to=Parent(0x02) focus=0x03800031 time=0x01ebf584
26.467 002:<:1381: 60: Request(18): ChangeProperty mode=Replace(0x00) window=0x03800030 property=0x23("WM_HINTS") type=0x23("WM_HINTS") data=0x00000067,0x00000001,0x00000001,0x03800034,0x00000000,0x00000000,0x00000000,0x0380003b,0x03800001;
26.467 002:<:1382: 12: XInputExtension-Request(131,40): XIQueryPointer window=0x03800030 device=2
26.468 002:>:1382: Event PropertyNotify(28) window=0x03800030 atom=0x23("WM_HINTS") time=0x01ebf588 state=NewValue(0x00)
26.468 002:>:1382:88: Reply to XIQueryPointer: root=0x0000054e child=0x00000000 root_x=1529.000000 root_y=598.000000 win_x=1.000000 win_y=-27.000000 same_screen=true(0x01) mods={base_mods=0x00000000 latched_mods=0x00000000 locked_mods=0x00000000 effective_mods=0x00000000}; groups={base_group=0x00 latched_group=0x00 locked_group=0x00 effective_group=0x00}; buttons=;
26.468 002:<:1383: 12: Request(42): SetInputFocus revert-to=Parent(0x02) focus=0x03800031 time=0x01ebf585
26.469 002:<:1384:  8: Request(54): FreePixmap drawable=0x03800043
26.469 002:<:1385: 12: Request(98): QueryExtension name='SYNC'
26.470 002:>:1385:32: Reply to QueryExtension: present=true(0x01) major-opcode=134 first-event=83 first-error=134
26.470 002:<:1386:  8: SYNC-Request(134,17): DestroyFence fid=0x03800044