JavaScript Full Screen API, Navigation Timing and repeating CSS Gradients

#1

Post by typester » Thu, Jan 13, 2011, 1:45 AM UTC

JavaScript Full Screen API, Navigation Timing and repeating CSS Gradients
peter.sh

Re: JavaScript Full Screen API, Navigation Timing and repeating CSS Gradients

#2

Post by bretthopper » Thu, Jan 13, 2011, 3:27 AM UTC

This is part of an ongoing series tracking updates to Webkit and Chromium in case it wasn't clear by the title.

Re: JavaScript Full Screen API, Navigation Timing and repeating CSS Gradients

#3

Post by there » Thu, Jan 13, 2011, 3:34 AM UTC

i just downloaded a webkit nightly and tested the full-screen api from his site.

my first thought was that someone could make a page respond to a user clicking a link and instead of navigating to it, make the page go full-screen and draw fake window chrome on the page to trick the user into thinking the browser is on a new site. it's like the old window.popup() stuff but this time you can completely remove the browser's own window decorations.

i hope the final implementation gets some kind of prompt or other warning to the user before going full-screen.

Re: JavaScript Full Screen API, Navigation Timing and repeating CSS Gradients

#4

Post by mnutt » Thu, Jan 13, 2011, 4:57 AM UTC

there wrote: post #3

i just downloaded a webkit nightly and tested the full-screen api from his site. my first thought was that someone could make a page respond to a user clicking a link and instead of navigating to it, make the page go full-screen and draw fake window chrome on the page to trick the user into thinking the browser is on a new site. it's like the old window.popup() stuff but this time you can completely remove the browse…

The same attack is also possible with Flash's fullscreen; their "Press Esc to exit Fullscreen" message would work fine here too.

Re: JavaScript Full Screen API, Navigation Timing and repeating CSS Gradients

#5

Post by sil3ntmac » Thu, Jan 13, 2011, 7:02 AM UTC

mnutt wrote: post #4

there wrote: post #3

i just downloaded a webkit nightly and tested the full-screen api from his site. my first thought was that someone could make a page respond to a user clicking a link and instead of navigating to it, make the page go full-screen and draw fake window chrome on the page to trick the user into thinking the browser is on a new site. it's like the old window.popup() stuff but this time you can completely remove the browse…

The same attack is also possible with Flash's fullscreen; their "Press Esc to exit Fullscreen" message would work fine here too.

I don't think so... isn't the keyboard disabled in Flash fullscreen? Same goes for Silverlight and Java applets.

Re: JavaScript Full Screen API, Navigation Timing and repeating CSS Gradients

#6

Post by trampsymphony » Thu, Jan 13, 2011, 7:08 AM UTC

sil3ntmac wrote: post #5

mnutt wrote: post #4

Earlier quoted context omitted.

The same attack is also possible with Flash's fullscreen; their "Press Esc to exit Fullscreen" message would work fine here too.

I don't think so... isn't the keyboard disabled in Flash fullscreen? Same goes for Silverlight and Java applets.

The keyboard remains active in Flash fullscreen, though you cannot bind anything to the "ESC" key if I'm remembering correctly.