Your system may not meet the requirements for Firefox, but you can try one of these versions:

Your system doesn't meet the requirements to run Firefox.

Your system doesn't meet the requirements to run Firefox.

Please follow these instructions to install Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2008-05

Directory traversal via chrome: URI

February 7, 2008
Gerry Eisenhaur
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox
  • SeaMonkey 1.1.8
  • Thunderbird


Gerry Eisenhaur reported the chrome: URI scheme improperly allowed directory traversal that could be used to load JavaScript, images, and stylesheets from local files in known locations. This traversal was possible only when the browser had installed add-ons which used "flat" packaging rather than the more popular .jar packaging, and the attacker would need to target that specific add-on.

Mozilla researcher moz_bug_r_a4 reported that this vulnerability could be used to steal the contents of the browser's sessionstore.js file, which contains session cookie data and information about currently open web pages.


Disable "flat-packaged" add-ons until a version containing these fixes can be installed.