Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Some sites, like StackExchange, pop up an "Are you sure you want to leave this page?" dialog when you try to leave under certain conditions, such as if you have a post you haven't finished editing. This is helpful!

Unfortunately, malicious or infected sites like to use the same functionality to say, "Hey! You haven't installed our malwareantivirus to address the 111 viruses we're definitely not lying about finding on your computer!", and the "Leave this page" and "Stay on this page" options are replaced by something like "Be safe. Install our product" and "Shoot yourself in the foot". This is unhelpful!

Javascript can do some nasty stuff. When I get one of those dialogs trying to keep me from leaving a clearly-malicious site, what should my response be? Is it safe to click "Leave this page" or whatever they replaced the text with? Could a site change the behavior of the button, or intercept my attempt to navigate away and draw its own fake dialog that does whatever an attacker wants when I click on it?

share|improve this question
1  
I'd just kill the whole browser process from process explorer or its equivilent. Much safer, since you don't know that the button actually says. –  Journeyman Geek Aug 31 '13 at 9:20

3 Answers 3

up vote 9 down vote accepted

There's only one way to perform some action when a page is closing: through the onbeforeunload event. Of course this could be easily used against the user (for example when he tries to close a page, it opens its copy in a new window), so it's very limited.

Actually the only reasonable thing you can do is open a dialog with custom text and two buttons, one to leave the page and one to stay. Only thing a page can do with that dialog is define its text. Buttons and titlebar are immutable. Here's a screenshot from Firefox 3.6: (very old version of Firefox)

Screenshot from Firefox 3.6

Of course when you let people show popups with any text and just OK/Cancel buttons, then you can be sure that sooner or later some guys will use it against you.

Screenshot of a malicious windows from Firefox 3.6

In the above screenshot OK means just "Leave this page", but the custom description suggests something more. So browsers have changed the dialogs so it's harder to make them misleading. For example recent versions of Firefox seems to ignore the custom text:

Screenshot from Firefox 23

Chrome shows the custom text, but always appends a question asking user what does he want to do and the buttons explicitly state their actions: (but it's still prone to the "cat videos" messages!)

Screenshot from Chrome 29

Here's Internet Explorer 10, also "cat-prone":

Screenshot from IE 10

Opera 12 just ignores the onbeforeunload event and if you try to close a tab like that, it will close just like any other. I haven't tested latest Opera, though.

So, to sum up the most important things:

  • Pages cannot show dialogs with any text. Website can ask browser to show a dialog with a custom text, but the browser can ignore it altogether (Opera), use generic text (Firefox) or explicitly say what will happen (Chrome, IE).
  • Details of the dialog depend on the browser you're using, but buttons are always immutable. If they won't say explicitly which one does what, then OK means "leave this page* and Cancel is "stay here".
  • Websites cannot perform any malicious actions if you decide to leave them. Your files won't be replaced with cat videos, you won't be flooded with 135234 viruses and FBI won't be informed that you have illegal software on your computer.

You can disable onbeforeunload event if you want to, effectively preventing pages from asking you to leave or stay. Here's a cross-browser userscript.

If you're on a specific website that shows a malicious popup and you're still afraid to click Leave, you can create a bookmarklet to remove it. Right-click your bookmarks bar, choose New bookmark (or equivalent) and paste this as an URL: (it's just minifed code from the above link)

javascript:var x=document.createElement('script');x.type='text/javascript';x.innerHTML='onbeforeunload=function(){};';document.body.appendChild(x);

Then just click that bookmark and the popup will be temporarily removed from the active page.

If you want to test how those popups look in your browser or test the bookmarklet/userscript, create a text file with the following code and save it as a .html file:

<html><body onbeforeunload="return 'My custom text.'">_</body></html>
share|improve this answer
1  
I'd press "OK" on that second one. After all, who doesn't want more cat videos? –  Daniel R Hicks Aug 31 '13 at 11:56
    
Ooh, Javascript to disable the dialog. Nice! –  user2357112 Aug 31 '13 at 19:15

This is the window.onbeforeunload event and a feature of the web browser. So this should be a fixed dialog of the web browser. You can try in different browsers and so you can see, the dialogs are in different designs.

But I assume, you could develop a popup with javascript, which looks like very very similar to the original popup of the browser's one. And if it is a good developer, he would also check browser type before showing the dialog. ;)

So to be very sure about an original dialog, you should cross-check in parallel the correct dialog, i.e. here: http://samples.msdn.microsoft.com/workshop/samples/author/dhtml/refs/onbeforeunload.htm

See here for further information about the event:
https://developer.mozilla.org/en-US/docs/Web/API/window.onbeforeunload
http://msdn.microsoft.com/en-us/library/ms536907%28VS.85%29.aspx

share|improve this answer

Quick workaround if you don't trust the "popup" & its intentions/actions:

For Chrome:

  • Escape to remove pop-up

  • Right-Click on Page

  • Select Inspect

  • Scroll to the top

  • Right-Click on tag

  • Delete Node

  • Close Tab

I'm sure the other browsers have similar options.

share|improve this answer
2  
Quicker workaround: always click Leave this page ;) –  gronostaj Jun 20 at 14:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.