Mozilla Fixes Vulnerability in Firefox Allowing Unscrupulous Websites to Launch Applications Without User Permission

CVE-2024-8383

Summary

A vulnerability exists in Firefox due to improper input handling for Usenet-related schemes (news: and snews:). The browser fails to prompt users for confirmation before delegating the handling of unsupported schemes to the operating system. This can lead to potential exploitation where an untrusted application is activated without user consent, especially since many operating systems lack a pre-installed trusted newsreader. This issue poses significant risks as malicious websites could leverage this flaw to execute unauthorized programs, potentially compromising user security. Affected versions include Firefox versions before 130, Firefox ESR versions before 128.2, and Firefox ESR versions before 115.15.

References