IMDb Plays Trailer Preview

[trailerman]

Even though i disabled media element, IMDb plays video preview. If i want to play the trailer, first i click to video. After that i can see noscript block video. I click on it and allow. I refresh the page and click play. This way i can watch the video. This is the example page: https://www.imdb.com/title/tt14174940/

What i wonder is that if it is a vulnerability or not.

[barbaz]

I can confirm what you're describing, and AFAICT it's all expected behavior, I'm just not sure why a refresh is needed to see video (I get only the audio if I don't refresh the page)

What part of this do you think might be a vulnerability and why?

[trailerman]

I can confirm what you're describing, and AFAICT it's all expected behavior, I'm just not sure why a refresh is needed to see video (I get only the audio if I don't refresh the page)

What part of this do you think might be a vulnerability and why?

I mean, i block media element but it plays the video preview. i though it is also a video, so it plays video.

[barbaz]

You block media elements in general, but you allowed that specific video.

When you do this...

first i click to video. After that i can see noscript block video. I click on it and allow.

... it's not just allowed once for that specific load of the page, NoScript creates a permanent CUSTOM permission for the video. It will remain allowed until you change that manually in NoScript Options > Per-site Permissions.

[trailerman]

Sorry for my unclear explanation. I meant the IMDb plays the video preview by itself without interaction. If you want to watch all of them, you can click on it and the same procedure mentioned above. Isn't video preview also a video and media element? So, someone can craft malicious video and that preview would infect your PC or something like that maybe?

[trailerman]

No one knows something about this?