Mozilla browser "about:" exploit

[sidki3003]

Siamesecat Wrote:I was not trying to catch "src=", but "about:<whatever>" exploits.&nbsp; I read somewhere that many of the "about:*" codes can be exploited by malicious code, but had not thought much about it until this demo came along.

Where? As you said, the exploit you referred to deals with printing an iframe source. "about:blank" was just an example, it works with "/nicepath/nicename.html" as well (and has been fixed in the nightly builds). See here for a "non-about" crash.

Quote:Could a web page query my browser with, for instance, "about:plugins" to find out what plugins I had installed?

Pages like "about:mozilla" work only locally, like that "I can see your hard disk!" followed by a "file:///c:/" iframe joke. The security relevant pages are disabled for remote webpages in Mozilla anyway - see here.

sidki