Related information

Multiple browsers OnUnload event handler different vulnerabilities

RE: MSIE7 browser entrapment vulnerability (probably Firefox, too)

Mozilla Foundation Security Advisory 2007-08

Secunia Research: Internet Explorer 7 "onunload" Event Spoofing Vulnerability

Firefox onUnload + document. write() memory corruption vulnerability (MSIE7 null ptr)

From:	Michal Zalewski <lcamtuf_(at)_DIONE.IDS.PL>
Date:	23.02.2007
Subject:	Firefox: onUnload tailgating (MSIE7 entrapment bug variant)

On Fri, 23 Feb 2007, Michal Zalewski wrote:

> Firefox isn't outright vulnerable to this problem, but judging from its
> behavior, it is likely to be susceptible to a variant of this bug

And indeed, susceptible it is. On the surface, the problem is even more
serious: the unloaded page can run Javascript in the context of a newly
loaded one.  Fortunately, at the time this is possible, 'document' and
'window' DOM hierarchies are not accessible - but then, 'location' is.
With a bit of clever trickery, we can mount the following attack:

 http://lcamtuf.coredump.cx/ietrap/ff/

As shown there, the problem is less serious than MSIE7 full-scale
Matrix-esque entrapment, but nevertheless - the bug is a cool one. And I
have a gut feeling this Javascript page jumping can be turned into
something nasty.

Bugzilla:
 https://bugzilla.mozilla.org/show_bug.cgi?id=371360

/mz