Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been asking myself for a while what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website.

It appears to be a security measure against some sort of potential threats, but what is it about exactly? Which attack scenarios could be carried out without that?

share|improve this question
Related: CTRL+ALT+DEL Login - Rationale behind it? – CodesInChaos Aug 22 '14 at 9:07
up vote 72 down vote accepted

The question is asked mostly to protect you from phishing attacks. The website may fake an Operating system, and ask you to enter sensitive information like passwords. To quote the spec:

User agents should ensure, e.g. by means of an overlay, that the end user is aware something is displayed fullscreen. User agents should provide a means of exiting fullscreen that always works and advertise this to the user. This is to prevent a site from spoofing the end user by recreating the user agent or even operating system environment when fullscreen.

There is also a very good discussion of this issue from Feross Aboukhadijeh, who also describes the security risks of allowing keyboard input.

share|improve this answer
I don't think that that is, strictly speaking, phishing. Perhaps "social engineering" might be a better phrase? – KnightOfNi Aug 23 '14 at 22:13
@KnightOfNi phishing is a form of Social engineering. For me its phishing: a web site that masquerades as a specific entity to get access to sensitive information. – user10008 Aug 24 '14 at 0:52
I never said phishing wasn't social engineering, but that doesn't make all social engineering phishing... – KnightOfNi Aug 24 '14 at 2:07
@user10008 the explanation is clear, thanks! Although I still don't understand what "allow" means. By specification, it should be enough to show a clear overlay telling that the fullscreen has been triggered. But what's the semantic of "Allow"? There is no restriction in place, at least on Chrome. User input is permitted even before the "allowance" (e.g.: on Facebook you can tag photos while the popup is still there). Bad browser implementation, bad UX or am I missing something? – Nicola Miotto Aug 24 '14 at 8:59
@KnightOfNi therefore my answer has a second sentence. The only difference between "normal" phishing is that not a website gets faked, but the operating system. Zulfikar Ramzan defines phishing through: Phishing attacks [...] typically stem from a malicious email, that victims recieve effectively convincing them to visit a fradulent website at which they are tricked into divulging sensitive information [...]. – user10008 Aug 24 '14 at 15:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.