This is probably an old question, but I couldn't find the answer after searching here and Google, though I admit I didn't spend a ton of time on it (clicked through the first few pages and found a lot of results from advertising sites).

So, even with the advanced settings of Javascript in Firefox set to disallow changing the status bar, Google's pages do it. I found that once I right-clicked a link, the real address would later show up. But how can they change the status bar anyways? Is it a flaw in Firefox? I got thinking of this from an earlier article about how they change the context menu in Google Presentations (which didn't actually come up with an answer did it?).

Thanks.

When the status bar displays one URL but clicking the link takes you to another one, Google are modifying the HREF value on the A tag using client-side JavaScript that gets fired by the ONCLICK event.

(I assume if you switch off JavaScript altogether, you'd be taken straight to the URL that gets displayed in the status bar.)

Nick: I assume you're thinking about what happens when you right-click a link on the google search results page (SERP) and the status bar shows a rewitten address.

What's happening here is that when you [right-]click on the link google actually re-writes the link within the HTML to a google.com/url?url=... address. Now when you later hover over the link you see the re-written address in the status bar as the actual link url has been rewritten and, as with any regular URL, shows up in the status bar which is normal firefox behaviour.

So Google isn't actually changing the status bar message directly.

--
Motti

Ah, Tony got there first!

Aha, that makes sense. That's a sneaky workaround though, and sort of defeats the purpose of the Firefox security, if you call it that.