Am I safe from this exploit if I disable Javascript?

zenexer · on May 11, 2018

You may be protected from the specific examples provided in the blog post, but, on the whole, you will not be protected. Most of the underlying vulnerabilities here can be exploited with simple HTML and CSS.

yorwba · on May 11, 2018

Content blockers can also prevent embedded iframes from loading. The article looks like this for me using uMatrix in Firefox: https://i.imgur.com/pYFXRR3.png

Clicking the link opens the iframe in a new tab, so it's hard to click it again without noticing what's going on.

ChoGGi · on May 11, 2018

You can make it a bit more visible if you use the Stylus extension.

Unfortunately Chrome (and probably Firefox quantum) doesn't let you apply css agent_sheets (only user/author), so that style="display:none!important" on the iframes can't be overridden.

If you use older Firefox or Palemoon then you can use Stylish v2.0.7 and override it.

  /* AGENT_SHEET */
  iframe:hover{cursor:help!important}
  iframe{border:1px solid red!important;display:block!important}
  *{opacity:1!important}