You are here: Known Vulnerabilities in Mozilla Products (Firefox > MFSA 2008-08

Mozilla Foundation Security Advisory 2008-08

Title: File action dialog tampering
Impact: Moderate
Announced: February 7, 2008
Reporter: Michal Zalewski
Products: Firefox

Fixed in: Firefox


Security researcher Michal Zalewski demonstrated that timer-enabled security dialogs can be subverted by attackers using JavaScript to change the window focus. Zalewski showed that a user could be tricked into confirming a security dialog of this type by bringing the dialog back into focus right before a user clicked in a predictable time and place.


Disable JavaScript until a version containing these fixes can be installed.