Then you haven't seen aggressive enough scripts. It's certainly possible using perfectly standard usage of web standards to cause a denial of service attack to most browsers in that way.

Doing a new pop-under tab in the onclose-handler seems to work pretty ok.

Have you ever gotten a popup message box in a web browser before? Pretty much all web browsers support them, and you can't click on any browser UI until you address the prompt.

...and then the web page can pop up another alert before you have time to do anything else.

    for (;;) alert("spam!");

Chrome will, at least, give you an option to disable the alerts if it thinks you're getting them too often, but by that point you're well into scary territory.

Footnote: just tried it in Chrome, and after disabling popups I got a tab which was spinning using 100% CPU and which was completely uninteractive. I couldn't even close it using the x on the tab and I had to kill it via the Chrome task manager. Hmmm...

There was a time when using vimperator with firefox you'd always be able to focus the command prompt and enter a command like :q to close the tab, even if there's an active alert popup on the screen.

It's hilarious to me that this thing is still a problem when it's technically trivial to solve.

Actually I don't know if the feature was due to vimperator, firefox, or just my window manager.

I have no idea what you're talking about. I tried it and after the first popup there's a checkbox to disable any more popups. It didn't affect any of my other tabs and I could kill the process of that one tab through task manager.

Chrome (and I assume others) put a checkbox to prevent the webpage from opening to popups in the popups if a site does it to often.

Edge does it as well, but I advise people not to click buttons on malicious webpages. So the fact that you have to click the button on the malicious webpage several times to get the option to disable it is very irritating.

Huh, they haven't worked that way in Firefox for ages. Just tested in Chrome and Edge and they both have that problem though.

Safari also traps alert()s inside the tab and you're free to use all of the browser chrome.