Mozilla Foundation Security Advisory 2005-39
Arbitrary code execution from Firefox sidebar panel II
- Announced
- April 15, 2005
- Reporter
- Kohei Yoshino
- Impact
- Critical
- Products
- Firefox
- Fixed in
-
- Firefox 1.0.3
Description
Sites can use the _search target to open links in the Firefox sidebar. Two missing security checks allow malicious scripts to first open a privileged page (such as about:config) and then inject script using a javascript: url. This could be used to install malicious code or steal data without user interaction.
Workaround
Disable Javascript