Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2005-37

Code execution through javascript: favicons

Announced
April 15, 2005
Reporter
Michael Krax
Impact
Critical
Products
Firefox, Mozilla Suite
Fixed in
  • Firefox 1.0.3
  • Mozilla Suite 1.7.7

Description

Firefox and the Mozilla Suite support custom "favicons" through the <LINK rel="icon"> tag. If a link tag is added to the page programmatically and a javascript: url is used, then script will run with elevated privileges and could run or install malicious software.

Workaround

Disable javascript.

References