Potential Data Leakage Flaw Found in Firefox

Security researcher Gerry Eisenhaur of Hiredhacker.com has released details of a flaw in the Firefox browser which could lead to an attacker gaining unauthorized access to your data. In order for the flaw to be properly exploited, the victim needs to have an extension installed that does not use the jar archive format for storing its contents. These include the popular add-ons Greasemonkey and Download Statusbar.

Eisenhaur has posted a demo which silently reads the preferences file of Mozilla Thunderbird. Read more about this flaw from PC World's Robert McMillan.