5.5 Disable Raising or Lowering of Windows via Scripts

Information

This setting allows the configuration of how Firefox handles scripts from raising or lowering browser windows.

Rationale:

An arbitrary web site raising or lowering the browser window can cause improper input or can help disguise an attack taking place in a lowered window.

Impact:

Scripts will not be able to raise or lower browser windows.

Solution

To establish the recommended configuration, set dom.disable_window_flip to true:

Type about:config in the address bar

Type dom.disable_window_flip in the filter

Ensure the setting is set as prescribed.

OR

Open the mozilla.cfg file in the installation directory with a text editor

Add the following lines to mozilla.cfg:

lockPref('dom.disable_window_flip', true);

Default Value:

True (Disabled).

See Also

https://workbench.cisecurity.org/files/4299

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-7, 800-53|CM-7(1), 800-53|SI-7, 800-53|SI-7(1)

Plugin: Windows

Control ID: 1deb9ef1b7169ea16335c17503014393569c72d79a619f7012d0479f27c8c60f