Can't close fullscreen "Deceptive site ahead" warning

nulano

I'm not sure how it appeared, but when switching to a different window, the "Deceptive site ahead" message popped up. There was nothing else visible for the window, no tabs, no address bar, no close button. Pressing Ctrl+W did not close the offending tab. Pressing "Back to safety" just replaced the red screen with a plain white window; the menu did not appear. I could not even close the window and had to kill Vivaldi with the Task Manager. Upon restart, the window with this tab reopened with the same warning message.

I also tried pressing "visit this unsafe site", but that just crashed Vivaldi.

The only way I could close it was to disconnect my internet connection, kill and restart Vivaldi, and close the tab before the message could load.

I could reproduce the effect in a new window by visiting https://testsafebrowsing.appspot.com/s/phishing.html and restarting the browser such that the test website tries to load on startup; instead the message above appears again.

Ayespy

@nulano Are you able to browse normally at all at present?

And do you have any tabs or sessions that you are particularly attached to?

nulano

@ayespy I was able to recover my session by unplugging the ethernet cable and restarting Vivaldi, then closing the tab before reconnecting to the internet.

Ayespy

@nulano But did that get rid of it, or will it come back?

sgunhouse

@ayespy '"Will it come back?" It seems like he uses Continue from previous session rather than a saved session, so it won't come back until he visits another phishing site while in full-screen mode. (Which he is unlikely to do intentionally, but that doesn't mean it won't happen.)

Pathduck

@nulano Well, pyfound.blogspot.com is not a deceptive site or doing phishing. From what I can tell it's the official news blog from the Python Software Foundation. It's even linked from the offical python.org.

So something else is going on. But might've been a temporary glitch in the Google Safebrowsing system. Or maybe something on your system is showing this warning for a legitimate site to trick you into clicking something else.

Did you have the pyfound news site opened earlier, and were you aware you were visiting it?

I don't understand the screenshot either, it looks like a fullscreen browser window, but why isn't the content centered, and what's the deal with the blurring down on the left side, and why does it show the window preview from the taskbar?

nulano

'"Will it come back?" It seems like he uses Continue from previous session rather than a saved session, so it won't come back until he visits another phishing site while in full-screen mode. (Which he is unlikely to do intentionally, but that doesn't mean it won't happen.)

Almost correct. At no point did I enter fullscreen mode myself, the warning switched to fullscreen mode by itself.

@pathduck said in Can't close fullscreen "Deceptive site ahead" warning:

@nulano Well, pyfound.blogspot.com is not a deceptive site or doing phishing. From what I can tell it's the official news blog from the Python Software Foundation. It's even linked from the offical python.org.

So something else is going on. But might've been a temporary glitch in the Google Safebrowsing system. Or maybe something on your system is showing this warning for a legitimate site to trick you into clicking something else.

Searching the web, it looks like Google's Safebrowsing system marked the blogspot domain as phishing for all websites for a short time: https://www.arlingtoncardinal.com/2021/05/googles-blogger-platform-temporarily-displays-deceptive-site-ahead-alerts-on-blogspot-website/

Did you have the pyfound news site opened earlier, and were you aware you were visiting it?

I had it open in another tab in the same window, but it was not even loaded since the last restart. The warning appeared when I was trying to switch to a completely different tab. I think the warning might have appeared when I opened the Window side panel (showing the list of tabs) to find the tab I was looking for. I'm guessing the warning appeared when Vivaldi tried to refresh the site's favicon.

I don't understand the screenshot either, it looks like a fullscreen browser window, but why isn't the content centered,

I have two monitors and did a poor job of cropping out the right monitor as I was in a hurry, so there is a small amount of red cropped off on the right side (no UI elements, just the background).

and what's the deal with the blurring down on the left side, and why does it show the window preview from the taskbar?

I had the mouse on the taskbar to show that the taskbar preview for the window shows that the red warning was full screen. I blurred the other open windows for privacy.

Ayespy

@nulano So the problem here is, when the Google "deceptive site ahead" popup takes over the UI, Vivaldi does not have a convenient way to dismiss it.

Pathduck

@nulano said in Can't close fullscreen "Deceptive site ahead" warning:

Searching the web, it looks like Google's Safebrowsing system marked the blogspot domain as phishing for all websites for a short time: https://www.arlingtoncardinal.com/2021/05/googles-blogger-platform-temporarily-displays-deceptive-site-ahead-alerts-on-blogspot-website/

Good find!
(and way to go Google...)

FYI If you trust your own ability to consider whether a site is bad or not, you can easily turn off SafeBrowsing under Settings > Privacy > Phishing and malware... I have it turned off myself and instead I trust Avast's webshield, it very rarely gives false positives and if it does reporting a false positive is relatively easy compared to trying to get Google to do anything...

But before you do that it would be very interesting to know how you managed to get in a state where the Vivaldi UI could not be used. I tried with the test site, setting it to launch on startup but it just opens in a regular tab and can be closed like any other tab. I can't understand how the issue you're describing would appear at all unless (like it's been suggested) accidentally hit F11 to go fullscreen.

nulano

@pathduck said in Can't close fullscreen "Deceptive site ahead" warning:

But before you do that it would be very interesting to know how you managed to get in a state where the Vivaldi UI could not be used. I tried with the test site, setting it to launch on startup but it just opens in a regular tab and can be closed like any other tab. I can't understand how the issue you're describing would appear at all unless (like it's been suggested) accidentally hit F11 to go fullscreen.

I should have also mentioned in the first post that I did try pressing F11 a few times in case it was in fullscreen mode, but that also had no effect. Trying it now on the test site I can go to fullscreen and back without any issues. F11 also covers the taskbar which was not the case here.

Of course I can't reproduce this issue anymore... This are the steps that I took when the issue first appeared as I remember them, in case something here rings a bell:

I was working in another program and needed to referece Vivaldi window A. Minimizing the program, Vivaldi window B was on top, so I Alt-Tab switched to A.
I switched the side panel from Downloads to Window to search for a tab and I think I had just started typing or scrolling the list when
the window froze for a second, then switched to the fullscreen warning. None of F5, Ctrl-R, Ctrl-W, F11, Alt-F4 had any effect, so I pressed Back to safety and only got a white screen instead. I'm fairly sure I did not click on the offending tab at this time.
I sometimes run out of memory due to the amount of tabs I have open, or due to a memory leak in some program, so I checked Windows Task Manager for memory usage (both actual and commit), both were several GBs below the limit. I would write this off as a memory issue from earlier (can't remember if I restarted since the last time I ran out of memory, but I did not have any issues for a few days before this happened) if it disappeared after restarting Vivaldi a few times, but it kept appearing after restarts.
I also checked the Vivaldi Task Manager at some point, but did not see anything obvious.
I used Help>Check for updates which failed for some reason at first (IIRC it said that the file was corrupted or something?), but trying again worked, downloaded an update and restarted Vivaldi. The warning reappeared in fullscreen again (I have Startup with Last Session enabled). After restart, I also tried the proceed to website anyway button, but it had no effect.
I tried looking in the Vivaldi menu for a way to close tabs from another window and found the Report a bug button, so I took a screenshot of window A.
I found the test site from another forum post here and opened it in a new window C. It appeared normally with the warning where expected, not covering the menu. I could press the continue to website button to show the test site. I think I opened the Window side panel it this window as well.
Around this time I made a copy of the Session and Tabs files, but I'm not sure if that would be helpful to analyze this. Looking at them with a hex editor, I can see both the blog and test site were open, but I don't know what else to look for here.
I tried Vivaldi>Exit in window B to quit the browser, but it had no effect.
I killed Vivaldi through Windows Task manager. After restarting it, the session was restored as usual, and both windows A and C had the phishing warning show up in fullscreen, with F5, Ctrl-R, Ctrl-W, F11, Alt-F4 having no effect on window C. The warnings showed up before the menu did, I only saw the Vivaldi logo in the background while it was starting, then it immediately switched to the warning.
I turned off SafeBrowsing in the settings and disconnected from the internet, and restarted Vivaldi by killing the process again. I then closed the offending tabs and opened this thread.

Before this, the blogspot tab was not loaded since the last time I restarted Vivaldi (I have Lazy load restored tabs enabled). According to my history I opened the tab in March (I did not look at it since).

I have the following extensions installed, but I doubt they would cause this issue:

Here is a screenshot of my history from this time, showing that I was not using Vivaldi immediately before the issue, and that I restarted the browser a while later, but I think there are some pages missing here (I did restart the browser several times and I don't see that here, only the last restart). The 1:52 error is the test page while 1:58 shows the blog, 2:12 shows a tab from window D after the last restart. Times are in CEST.

nulano

Around this time I made a copy of the Session and Tabs files, but I'm not sure if that would be helpful to analyze this. Looking at them with a hex editor, I can see both the blog and test site were open, but I don't know what else to look for here.

I just tried restoring these Session files by renaming all other sessions in the directory, and it seems I made the copy just after closing window C (not quite sure how I did that, possibly by pressing the close button on the taskbar worked; I was not too keen on trying that with window A). The blog just appears normally when I switch to it, but it is not the active tab.

Pathduck

@nulano Thanks for trying to explain in detail how it might have happened and I'm sure it actually did trigger a bug in some way. Maybe due to a complex combination of multiple windows, hibernating/sleeping tabs and suddenly SafeBrowsing deciding the site is malicious.

Only problem is if it can't be reproduced there's very little that can be done by making a bug report about it, as the developer would need to be able to do the same.

So at the moment it can be chalked up to a "weird glitch" I guess. But if it ever does happen again let us know

Pathduck

@nulano Oh and I just thought of one thing, since you said you use a lot of tabs:

If the Vivaldi UI process crashes somehow, because of an Out-Of-Memory situation for example, you will end up with something similar to what you saw. So if that OOM happens to coincide with switching to the red blocked page, that could explain what happened. And like you said, only way to close it is Alt+F4 or terminating the process.

You also never said your OS, and especially if 32 or 64-bit. A 32-bit process will crash once process memory reaches a bit over 1.5GB, depending on different factors. A 64-bit process won't crash with OOM unless all your physical+paged memory is depleted.

nulano

@pathduck I'm familiar with the impossibility of fixing a bug without a way to reproduce it...

I could have tried to find a way to reproduce it earlier (especially as it affected the new window as well), but unfortunately did not have time to try it until now...

Hopefully if this happens to someone else, perhaps they can find this thread and share more information that might help. I might try to reproduce this a few more times, but I don't expect to be successful.

nulano

@pathduck I'm on Windows 10 64-bit version 2004 with Vivaldi regularly using 8-12GB of the 16GB available (not sure how much commit it uses of the 48GB available), but IIRC it was on the low end of what I usually see when this happened. I also never switched to the tab, it popped to the top by itself and was not active when I restarted the browser after disconnecting from the internet. And I'm not sure how this would explain the issue persisting after restarting the browser several times.

However, I am quite familiar with Vivaldi crashing when the system runs out of memory (Vivaldi seems to always crash when I run out of memory, sometimes even before the offending program does, and even if I close the offending program as soon as I notice it will cause a crash; other applications such as Outlook crash when this happens much less often, although to be fair they have a lot less content open).