If they do it right, I imagine the source of the event would be tainted, so that only an actual click received from the OS would be allowed to propagate through.<p>I&#x27;m sure it&#x27;s tricky to ensure this, though. Like pop-up blocking.