Fullscreen request on invisible document should be denied

[upsuper]

I suppose that exposes security risks that attacker can open a background window and put it into fullscreen without having user notice it. And then when user switches window, it may start spoofing.

[foolip]

Do you mean something like this?

document.onclick = function() {
  var win = window.open();
  win.document.body.requestFullscreen();
}