3 ms·
I appreciate your frustration, but I think you may be misunderstanding the security impact of browsers allowing top navigation. Either way, an exploit can still
by justinschuh 13y ago
I appreciate your frustration, but I think you may be misunderstanding the security impact of browsers allowing top navigation. Either way, an exploit can still be launched from within the nested browsing context (be it a plugin or HTML frame). So, the risk here is that some of the content (no matter how deeply nested) is being served from the same location as known malware. And the risk is the same regardless of whether or not the nested context can navigate top.
- invisible 13y agoGiven that most successful malware infected via a good browser (like Chrome) is obtained due by downloading (rather than an exploit) I'd say allowing top navigation is a pretty big concern. But if there is an exploit that targets a specific browser there is very little that anyone can do in advance if it is being served on an ad network. So, if as a normal user (someone that doesn't understand malware versus OS-level dialog) sees a big warning in their trusted browser (or a popup) without having clicked on anything at all they might be compelled to download some malware. So yes, getting sandboxed iframes right would have been amazing but in my mind it was a failure.
- invisible 13y agoJust to clarify "sees a big warning" - I had meant the fake warnings that a lot of malware display: "1000 INFECTIONS FOUND, DOWNLOAD THIS NOW!!!"