Firefox: onUnload tailgating (MSIE7 entrapment bug variant)

On Fri, 23 Feb 2007, Michal Zalewski wrote:

> Firefox isn't outright vulnerable to this problem, but judging from its
> behavior, it is likely to be susceptible to a variant of this bug

And indeed, susceptible it is. On the surface, the problem is even more
serious: the unloaded page can run Javascript in the context of a newly
loaded one. Fortunately, at the time this is possible, 'document' and
'window' DOM hierarchies are not accessible - but then, 'location' is.
With a bit of clever trickery, we can mount the following attack:

http://lcamtuf.coredump.cx/ietrap/ff/

As shown there, the problem is less serious than MSIE7 full-scale
Matrix-esque entrapment, but nevertheless - the bug is a cool one. And I
have a gut feeling this Javascript page jumping can be turned into
something nasty.

Bugzilla:
https://bugzilla.mozilla.org/show_bug.cgi?id=371360

/mz