Javascript: URLs run in privileged context on New Tab page

ID MFSA2012-95
Type mozilla
Reporter Mozilla Foundation
Modified 2012-11-20T00:00:00


Security researcher reported that if a javascript: URL is selected from the list of Firefox "new tab" page, the script will inherit the privileges of the privileged "new tab" page. This allows for the execution of locally installed programs if a user can be convinced to save a bookmark of a malicious javascript: URL.