Mozilla build 1999090408 (and earlier builds) allows executing JS code in the "file" protocol by injecting code in the bookmarks file. The problem are SCRIPT tags in the TITLE tag. Demonstration and more info is available at: http://www.nat.bg/~joro/mozilla/bookm2.html
Ok, I think I misunderstood the problem. Ignore my raving.
We should prevent <SCRIPT> from being saved in bookmark titles, descriptions, etc... that should plug the security hole.
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
Bulk moving all Browser Security bugs to new Security: General component. The previous Security component for Browser will be deleted.
Component: Security → Security: General
You need to log in before you can comment on or make changes to this bug.