window.close() can be triggered even didn't open by window.open()

Open
#1,480 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
javascript
Domain
desktop, security

Research direction

Start by saving the supplied HTML proof of concept, opening it in Wavebox, and clicking the javascript:window.close(self) link while comparing the result with Chromium. Then trace the window.close handling in the browser runtime; done means a normal tab no longer closes itself unless it was opened programmatically, and the supplied reproduction no longer closes the tab.

Written by the indexing model from the issue text.

Description

In the Wavebox browser, the window.close() method can be executed successfully even when the current window was not opened via window.open(). This behavior deviates from the standard implementation in most modern browsers (like Chrome, Firefox, Safari), which restrict the use of window.close() to windows opened programmatically. This unexpected behavior could be exploited by attackers to trick users into navigating to a phishing site, and then forcefully close the tab, erasing traces or interrupting user actions.

save this html file :

<html>
<title>Browser Window Object  Remote Denial of Service.</title>
<head></head>
 
<body><br><br>
<h1><center>Browser Window Object  Remote Denial of Service</center></h1><br><br>
<h2><center>Proof of Concept</center></br></br> </h2>
 
 
<center>
<b>Click the  below link to Trigger the Vulnerability..</b><br><br>
<hr></hr>
 
<hr></hr>
<b><center><a href="javascript:window.close(self);">Browser  Window Object  DoS Test POC</a></center>
 
</center>
</body>
 
 
</html>

Open then click on link. You should realize that the tab is closed when you click on that link. This behavior is not appears in chromium browser.

Dominant language
JavaScript
Stars
1.4k
Forks
136
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from wavebox/waveboxapp

All issues in wavebox/waveboxapp

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.