264943 - Potential spoofing via frame(set)

Status: VERIFIED DUPLICATE of bug 265123

(Core :: Security, defect)

Description

[Frank Wein [:mcsmurf]]

In IE recently a security bug was discovered that when you set
javascript:document.write("<iframe src='http://www.heisec.de' width='100%'
height='100%'></iframe>"); as homepage, visit for example http://www.mozilla.org
and go to your Homepage, it still displays http://www.mozilla.org as URL, but in
reality you're on www.heisec.de. For Mozilla the same applys, you just need
another URL javascript:document.write('<frameset><frame 
src="http://www.heisec.de" width="100%" height="100%"></frameset>')
If you then execute javascript:document.close() after it, it would close the
non-visible mozilla.org. I'm not sure if this such a critical bug, that it needs
fixing.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Same applies for current FF nightlies => Confirming.

Comment 2

[Boris Zbarsky [:bzbarsky]]

The page is still mozilla.org, since that's what wrote out the frameset.  I'm
not sure what makes you think "but in reality you're on www.heisec.de".

Comment 3

[Jesse Ruderman]

*** This bug has been marked as a duplicate of 265123 ***

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2]]

v.