3 ms·

I've experienced pop-ups occurring that go behind. It's not like you don't notice it or anything though. Should this be considered a chrome security flaw? You d

• fem 13y ago
  I don't think it's a flaw, as the UI evolves with the specs this hypothetical might be eliminated. But since as you mention the user would first have to grant permission, and the option to revoke is available "revoke and report" is the best course of action, I doubt Google SafeSearch would even let you land on said hypothetical malicious site.
• freshchilled 13y ago
  The problem is that you don't expect a pop-under to continue collecting information from you, especially when you intended to close the connection!
• sil3ntmac 13y ago
  I would say yes. Pop-unders should be blocked, and modern browsers work pretty hard to, but it is often viewed as a "low priority" sec issue, and so workarounds are found, ignored, used in the wild, and patched. Here is one implementation, I have seen working versions up to Chrome ~30: https://github.com/tuki/js-popunder https://github.com/tuki/js-popunder Another serious security issue is when the popunder waits for a while as the parent frame navigates itself to e.g. "java.com", then the child navigates the parent to a malicious drive-by download. This can make it appear to "spoof" a drive-by download. This attack vector has been known and ignored forever (I think Zalewski published about this years back). IE9 and 10 actually do a good job preventing this, but I know it works in most modern browsers.