Browsers hit by dialog box spoofing security flaw

By Simon Aughton

Posted on 22 Oct 2004 at 12:26

Several Web browsers are afflicted with a dialog box security vulnerability which can be exploited by malicious web sites to spoof dialog boxes.

Firefox, Internet Explorer, Mozilla, Netscape and Opera are affected by the flaw, where inactive windows can launch dialog boxes so they appear to be displayed by a website in another window or tab. This can be exploited by a malicious site to show a dialog box, which seems to originate from a trusted site.

Successful exploitation would normally require that a user is tricked into opening a link from a malicious web site to a trusted web site in a new window.

A safe demonstration of the problem can be seen in secunia.com's multiple browsers dialog box spoofing test.

Further information about the vulnerability is available as follows: Firefox and Mozilla; Internet Explorer; Netscape; Opera.