Denial of Service: Large Alert Boxes

  1. When web browsers display an alert message, the window holding the message does not provide scroll bars.
  2. The javascript code of a web page is allowed to produce the alert message.
  3. A long message results in a large windows. If the alert window is too large for the user's display, the windows' ordinay "Close" button cannot be reached with the mouse.
  4. Since the box is "modal", no other interaction with the browser is possible. This includes closing the browser the down (quit).
  5. If the user has javascript enabled, simply visiting a page may trigger this problem: the alert box can be shown from the "body onload" function.
  6. A savy user may press the "Escape" key, but this does not help with all browsers.

Click this Warning: you might lose control of your browser. The "Escape" key may help.

Vulnerabilities:

All of this should apply equally to the javascript "confirm" method (not tested).

Stephan Wehner, November 2006.
Home