SECURITY: iframe navigating top-level content - user gesture should be required

[asdasdasd]

security related bug to be checked please:

In general this deals with one of scam pages' techniques where IFRAME contained code would try to command the browser to change the top level content without user knowledge.


original info from CHROMIUM.ORG blog https://blog.chromium.org/2018/06/chrom ... creen.html:

"Beginning in Chrome 68, content embedded in an iframe will require a user gesture to navigate the top-level browsing context to a different origin. Similar to pop-up blocking, when this protection triggers users will see Chrome UI giving them the option to allow the redirect the continue."

You can check this behavior simulated in the demo, originally by Chromium.org blog referenced one: https://ndossougbe.github.io/web-sandbo ... -redirect/.

I have checked this through Slimjet (Version 20.0.2.0 (based on Chromium 68.0.3440.75) (Official Build) (32-bit); running in Windows 8.1, 8GB RAM, on Intel platform)


The navigation was cancelled indeed. However, Slimjet UI did not show a request to choose between cancellation and continuation. When I have right-clicked any of their 3 demo iframes, and chose to reload the iframe, the iframe related navigation continued, again without any UI dialog box = Slimjet continued as if I would explicitly choose to continue)

Maybe something on my side, could anyone else check on own comp and (un)confirm this behavior?

Thx, Meno

[CrockPot]

"user gesture" does not necessarily means a pop up informing you and asking you what to do.When there is a block iframe(s) like the ones from the test page look at your address bar next to the bookmark star there will be new icon there,click on it and will give you options.