Collected research

Browser Event Hijacking

Ben Toews · Neohapsis Labs · 14 November 2012

Calling preventDefault on the ctrl+f and cmd+f keydown lets a page suppress the browser's own find bar and draw a pixel-accurate replica instead. Anything the user types into that fake bar is readable by the site. Toews demonstrates it against Chrome on OSX and notes ctrl+s and ctrl+o could be hijacked the same way; Chrome rated it low priority.

Record

Researcher

Ben Toews

Published by

Neohapsis Labs

Date

14 November 2012

Topic

Browser

In the archive

• Collected in the 2012 research round

Related sources

• How script kiddies can hijack your browser to steal your password
• .[h43z]: what's real and what's not
• Browser-event hijacking demonstration

Tags

• javascript
• ui-redress
• dom
• info-leak
• mitigation
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Ben Toews, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.