CoolPreviews Vulnerability
Posted: Wed Jul 14, 2010 4:48 am
http://blog.mozilla.com/addons/2010/07/ ... ouncement/
The blog describes the vulnerability in CoolPreview asAdd-on security vulnerability announcement
One malicious add-on and another add-on with a serious security vulnerability were discovered recently on the Mozilla Add-ons site. Both issues have been dealt with, and the details are described below....
Mozilla Sniffer ...
CoolPreviews ...
Would NoScript block "the remote JavaScript code" attempting to run "with local chrome privileges"?A security escalation vulnerability was discovered in version 3.0.1 of the CoolPreviews add-on. The vulnerability can be triggered using a specially crafted hyperlink. If the user hovers the cursor over this link, the preview function executes remote JavaScript code with local chrome privileges, giving the attacking script control over the host computer.