I've done this with jQuery...not 100% sure why it doesn't work for you, but maybe there's something going on with the VF framework attaching its own events to the onclick handler of the button (conjecture by me). If you use jQuery you can attach your own event pretty easily and I know it works.
Anyway, back to the solution...it could be useful to have the script in some common JS file that you include in many pages where you want to hesitate on taking some generic cancel or save. Then you just give your commandbutton the proper styleClass and get the behavior immediately. For example's sake I just have it all in one page.
Put jQuery in your static resource, for example, in a zip called res in a subfolder called js and be sure to include it prior to using it.
Zip file with the following structure:
/res/js/jquery-1.8.1.min.js
Referenced from VF as follows:
<apex:includeScript value="{!URLFOR($Resource.res, 'js/jquery-1.8.1.min.js')}"/>
Example code snippet from VF
<script type="text/javascript">
jQuery.noConflict();
jQuery(document).ready(function() {
jQuery('.saveAction').click(function(e) {
if ( confirm('Are you sure you want to save? Click OK to continue saving.') ) {
return true;
}
e.preventDefault();
});
});
</script>
<!-- somewhere on your page is your button -->
<apex:commandButton action="{!save}" value="Save" styleClass="saveAction"/>
onclick="return confirm('Are you sure?');"
works fine in Firefox and Chrome right now. If user says OK (Yes) an action is executed. Maybe Salesforce fixed this issue.