Mozilla

mozilla

Mozilla Foundation Security Advisory 2012-95

Javascript: URLs run in privileged context on New Tab page

Announced
November 20, 2012
Reporter
kakzz.ng@gmail.com
Impact
Moderate
Products
Firefox
Fixed in
  • Firefox 17

Description

Security researcher kakzz.ng@gmail.com reported that if a javascript: URL is selected from the list of Firefox "new tab" page, the script will inherit the privileges of the privileged "new tab" page. This allows for the execution of locally installed programs if a user can be convinced to save a bookmark of a malicious javascript: URL.

References