In IE10 I've disabled JS execution by setting maximum security level (IE11 also affected).
Then I add or edit onmousedown
attribute on any element on any site (for example, body
element on www.google.com
).
<body onmousedown="alert('Hello')">...</body>
And so I get an alert when clicking anywhere.
Is it expected behavior or bug?