1986312 - Malicious website can subscribe a user to notifications by tricking them ("Click Allow to prove you are a human")

Status: NEW

(Core :: DOM: Notifications, enhancement)

Description

[Artur Iunusov]

Attachment: subscription process

I recently misspelled GMail. I simply typed gmail.com, but without the last "l" (Please don't try this unless you know what you're doing!)
This opened a malicious site.
I didn't notice the URL and simply checked the "I'm not a robot" checkbox. As a result, Firefox started spamming me with notifications that my browser was infected. But I didn't want to subscribe for any notifications.

I think we need to investigate this. It could be a security issue or some kind of "gray pattern".
Considering how popular Gmail is, this is a real problem for our users.

Comment 1

[Kagami Rosylight [:saschanaz] (they/them)]

The domain name looks much longer than gmai.com, and opening gmai doesn't do a redirection (maybe it's changed now?)

Manually trying to access https://d2qpmdanaffc73fe84cg.xsv-adguard.pro/x/?clickid=d2qpmdanaffc73fe84cg&lp_key=17567b88e1b8d250ea46ef63b33d37fe6e61632513 gives only 404 for me.

But clicking the checkbox alone can't grant the permission, it opens a permission prompt too and that would grant the permission (via Notification.requestPermission(), unless there's some way to circumvent that.

Comment 2

[Artur Iunusov]

Attachment: step 2. Firefox popup was shown

step 2 shows clearly that Firefox correctly showed permission request.
So, this is just a fishing website

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

So did the site keep spamming those notification permission popups?
Or did you accidentally accept notifications and then got lots of notifications?

Edit, nevermind, others answered.

Comment 4

[Daniel Veditz [:dveditz] back January 5, 2026]

I'm unhiding this because this is in fact a fairly popular abuse technique. It's hard to make permission interactions that are sufficient to protect users who mistakenly think they are somewhere else or believe the site that the "Allow" is something other than it is without at the same time making them extremely annoying in the legitimate case.

Maybe the permissions prompts would be more distinctive if they had a big Icon representing what permissions was being granted, although "notifications" are hard to represent.

Comment 5

[Andrew McCreight (out until 2026) [:mccr8]]

I'm going to change this to an enhancement. Things are currently working as intended, but the situation is not ideal so it would be good if we could come up with something better.

Comment 6

[Daniel Veditz [:dveditz] back January 5, 2026]

(In reply to Kagami Rosylight [:saschanaz] (they/them) from comment #1)

The domain name looks much longer than gmai.com, and opening gmai doesn't do a redirection (maybe it's changed now?)

These domains don't stick around long because they expect to get reported and blocked. Unfortunately those mechanisms take hours or days to kick in so the scammers still have lots of potential victims.