‘DoubleClickjacking’ Threatens Major Websites’ Security

Hackers are exploiting the split-second delay between two mouse clicks to carry out sophisticated clickjacking attacks, tricking victims into authorizing transactions or granting access they never intended.

See Also: Cracking the Code: Securing Machine Identities

Security researcher Paulos Yibelo probed a new twist on the tactic, in which attackers manipulate users into making a second click on concealed or deceptive elements, bypassing modern browser protections that block single-click hijacks.

Yibelo said the “DoubleClickjacking” technique poses a significant threat, enabling attackers to manipulate users into granting OAuth and API permissions on major platforms. This could allow malicious actors to disable security features, delete accounts, authorize access or transactions and confirm money transfers – all without the victim’s clear awareness.

Modern browsers have made single-click hijacking less viable by preventing cross-site cookies from being downloaded without user consent. In response, attackers are introducing a second click, layering deceptive elements over legitimate webpages. Traditional clickjacking has long posed a security threat by tricking users into clicking concealed buttons. Modern browser defenses such as SameSite cookies and X-Frame-Options have mitigated these attacks.

DoubleClickjacking circumvents these protections by leveraging a timing and event-order quirk in browser behavior. The technique manipulates the gap between the mousedown and click events during a double-click sequence, redirecting users to sensitive actions without their knowledge.

Yibelo wrote the attack begins with an attacker’s website opening a secondary browser window, often masked as a legitimate prompt, such as a CAPTCHA verification. During the first click, the top window closes, revealing a preloaded sensitive page, such as an OAuth authorization form, in the parent window. The second click, intended for the initial prompt, “unwittingly” authorizes malicious actions.

“This technique exploits event timing to hijack user actions seamlessly,” Yibelo said, adding that the attack works on all major platforms supporting OAuth and API integrations.

Yibelo provided proof-of-concept examples demonstrating account takeovers on platforms such as Salesforce, Slack and Shopify. Beyond websites, DoubleClickjacking poses risks to browser extensions and mobile applications, including cryptocurrency wallets and VPNs.

The vulnerability is effective across all platforms tested, Yibelo said. While some organizations have implemented fixes, many remain vulnerable due to the technique’s novelty and complexity.

Popular defenses such as Content Security Policy and SameSite cookies fail against DoubleClickjacking.

To mitigate the threat, Yibelo recommended a JavaScript-based client-side defense that disables critical buttons until users demonstrate intentional interaction, such as mouse movement or keypresses. This lightweight solution has already been adopted by platforms such as Dropbox and GitHub, ensuring that sensitive actions cannot be triggered by simulated or tricked clicks.

Yibelo also suggested browser makers adopt defenses such as a “Double-Click-Protection” HTTP header, which could block rapid context-switching during double-click events.