Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Whenever a user selects or highlights text on a webpage, an OnClick() event is generated. Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a new tab is opened, or software is downloaded.

  • That being said, is it a risk to highlight text while reading a webpage?

  • What can be done to mitigate this risk?

share|improve this question
Excellent question. As an inveterate highlighter, I'm often slammed when I hit a web site that pops up ads in response to OnClick() events. – gowenfawr Aug 31 '12 at 17:05

As far as I know the only risk could be your privacy since there are some widgets that sends back to the server what text you have selected. Browser add-ons such as Ghostery blocks these intrusive scripts.

share|improve this answer

This sounds related to what NoScript's ClearClick is designed to prevent. (The protection applies even if you have NoScript set to "Allow Scripts Globally").

share|improve this answer

It's hard to say just about anything isn't a risk if javascript is on. As far as I know, there is no good way to tell where an exploit might exist. That said, if you are really concerned about highlighting text on a page without risk, my recommendations would be to either a) turn off scripts such that onclick events don't occur, b) view source and copy the text directly out of the source or c) if the text is not available in the source, use a tool like firebug which can inspect the DOM and pull the text directly out of the DOM.

In general no-script on a site you don't trust is just good security to begin with though as there have been exploits that don't even require direct interaction with the page beyond simply loading it.

share|improve this answer

Wouldn't any user triggered event be a problem and not just OnClick?

But directly relevant to your question is clickjacking:

share|improve this answer

That being said, is it a risk to highlight text while reading a webpage?

There isn't a risk unless the browser has an exploit dealing when text is highlighted.

What can be done to mitigate this risk?

Any browser worth using wouldn't have an exploit.

I won't even address the concerns raised by AJ dealing with JavaScript mainly because that risk is unique to a given browser's engine.

share|improve this answer
"Any browser worth using wouldn't have an exploit." That's bold. They all seem to have various flaws at different times. – Jeff Ferland Aug 31 '12 at 21:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.