Mozilla Foundation Security Advisory 2014-21
Local file access via Open Link in new tab
- Announced
- March 18, 2014
- Reporter
- Alex Inführ
- Impact
- Moderate
- Products
- Firefox
- Fixed in
-
- Firefox 28
Description
Security researcher Alex Inführ reported that on
Firefox for Android it is possible to open links to local files from web content
by selecting "Open Link in New Tab" from the context menu using the
file: protocol. The web content would have to know the precise
location of a malicious local file in order to exploit this issue. This issue
does not affect Firefox on non-Android systems.