3 ms·

Attack doesn't seem to actually work. Unless I'm missing something? Tried it in incog mode too, nothing, js doesn't run. Looking in the console it says: Block

Attack doesn't seem to actually work. Unless I'm missing something? Tried it in incog mode too, nothing, js doesn't run. Looking in the console it says: Blocked opening 'http://translate.google.com/translate?hl=en&sl=ru&tl=en&u=http%3A%2F%2Fkremlin.ru%2F' http://translate.google.com/translate?hl=en&sl=ru&tl=en&u=ht... in a new window because the request was made in a sandboxed frame whose 'allow-popups' permission is not set. So the attack doesn't seem to work in Chrome. NB: Just tested on FF, works on that. Also homakov, I had to edit the iframe width/height just to be able to see the link in the first place because google's putting all the login stuff at the top, I'd suggest setting the height to 300px instead of 30px. Are you running something which stops that showing in your browser?

homakov 13y ago
> the request was made in a sandboxed frame whose 'allow-popups' permission is not set the GUC Page 1 (having a link inside) is not sandboxed and located on homakov.blogspot.com. Since it calls window.open on click chrome must not block opening a popup. I'm pretty sure you have specific/strict settings? >So the attack doesn't seem to work in Chrome. It worked for me, for my friends, and for people who +ed the item. Let's figure out what went wrong
homakov 13y ago
Login stuff? When I/my friends run it in incognito there is nothing but that link. There is some weird token in URL, but it seems to be valid for everyone. I made it 30px to hide "tooltips" on hover
- mattmanser 13y ago
  It's showing the top black bar with +You and all the other google links at the top, the stuff that's usually shown if you go to google not logged in. This is what I'm seeing: http://i.imgur.com/sau9mXU.png http://i.imgur.com/sau9mXU.png
  - rullgrus 13y ago
    Exactly the same for me. I'm using Firefox and I'm not signed in to Google+. Visiting the given URL in another tab works, but I have to click to disable the "Translated in Safe Mode"-feature first.
    - homakov 13y ago
      Safe mode disallows scripts. It should be disabled. Not sure about google plus, it works for me in incognito.
  - javajosh 13y ago
    Yep, that's what I'm seeing too, and nothing much happens when you click on anything, on Chrome or FF.

homakov 13y ago

> the request was made in a sandboxed frame whose 'allow-popups' permission is not set the GUC Page 1 (having a link inside) is not sandboxed and located on homakov.blogspot.com. Since it calls window.open on click chrome must not block opening a popup. I'm pretty sure you have specific/strict settings? >So the attack doesn't seem to work in Chrome. It worked for me, for my friends, and for people who +ed the item. Let's figure out what went wrong

homakov 13y ago

Login stuff? When I/my friends run it in incognito there is nothing but that link. There is some weird token in URL, but it seems to be valid for everyone. I made it 30px to hide "tooltips" on hover

mattmanser 13y ago
It's showing the top black bar with +You and all the other google links at the top, the stuff that's usually shown if you go to google not logged in. This is what I'm seeing: http://i.imgur.com/sau9mXU.png http://i.imgur.com/sau9mXU.png
- rullgrus 13y ago
  Exactly the same for me. I'm using Firefox and I'm not signed in to Google+. Visiting the given URL in another tab works, but I have to click to disable the "Translated in Safe Mode"-feature first.
  - homakov 13y ago
    Safe mode disallows scripts. It should be disabled. Not sure about google plus, it works for me in incognito.
- javajosh 13y ago
  Yep, that's what I'm seeing too, and nothing much happens when you click on anything, on Chrome or FF.