How Firefox's Pop-Up Blocker Detects User Interaction

This article explains the underlying mechanisms the Firefox Web Browser uses to distinguish between unwanted, automated pop-up advertisements and legitimate new windows requested by a user. By monitoring specific user-driven events, utilizing a temporary activation state, and enforcing strict limits on script execution timing, Firefox ensures that new windows only open as a direct result of intentional user action.

Allowed User Events

Firefox relies on a predefined list of Document Object Model (DOM) events to identify legitimate interaction. Actions that require deliberate physical input from the user are trusted, while passive or automated events are ignored.

When a webpage attempts to open a new window, Firefox checks what triggered the script.

• Trusted Events: Actions such as clicking a mouse button (click, mouseup), tapping a touchscreen (pointerup), or submitting a form (submit) are considered valid triggers.
• Untrusted Events: Passive actions like moving the mouse cursor (mousemove), scrolling down a page (scroll), or the webpage simply finishing its loading process (load) are not considered legitimate triggers for a new window.

In Firefox, this exact list of trusted triggers is controlled by an internal configuration preference named dom.popup_allowed_events. If a script tries to open a window during an event not on this list, the pop-up is immediately blocked.

Transient User Activation

To manage how and when scripts can open windows, Firefox uses a web standard mechanism known as "transient user activation."

When you perform a trusted action, such as clicking a button, Firefox grants the webpage's environment a temporary active state. This acts like a short-lived permission slip. When the JavaScript function window.open() is executed, Firefox checks if the webpage currently holds this permission slip. If the transient user activation state is true, the window opens. If the state is false, Firefox intercepts the request, blocks the window, and displays a notification bar alerting the user of the blocked pop-up.

Strict Timing Limits

Sometimes, a website needs to run a quick background check—such as verifying login credentials—after you click a button, but before it opens a new window. Because of this, Firefox does not require the pop-up to open at the exact microsecond of the click.

Instead, the transient activation state remains valid for a strict, brief timeframe, controlled by the dom.user_activation.transient.timeout preference (typically set to 5000 milliseconds, or 5 seconds). If the webpage's script finishes its task and triggers the new window within this timeframe, the pop-up is allowed. If the script takes too long, or if it uses a timer to intentionally delay the pop-up past this limit, the activation state expires. Once expired, Firefox assumes the pop-up is no longer directly related to the user's intent and blocks it.

Single-Use Token Consumption

A common tactic used by malicious websites is attempting to open multiple pop-up windows from a single legitimate mouse click. Firefox prevents this through a process called activation consumption.

The transient user activation state functions as a single-use token. The moment a script successfully calls window.open() to launch a new window or tab, Firefox consumes the token and resets the activation state back to false. If the same script attempts to open a second window a millisecond later, the request fails because the permission slip has already been used. To open another window, the user must perform another trusted interaction.