Language Selection

English French German Italian Portuguese Spanish

Silent installs of add-ons still possible in Firefox

Filed under
Moz/FF

A security researcher has demonstrated how it is still possible to silently install extensions, or as Mozilla calls them add-ons, for the open source Firefox web browser. In a blog post, Julian Sobrier of ZScaler detailed the process, which makes use of the fact that Firefox uses an Sqlite3 database to maintain information about which add-ons are installed and, of those, which ones have been approved by the user.

This feature, introduced in Firefox 8, was designed to stop toolbars and other applications adding in their own add-ons without informing the user. Sobrier's technique shows though that the mechanism is relatively easy to overcome. Add-ons have privileged access to the browser and therefore a malicious add-on could do anything including stealing the user's history, modifying pages' contents or disabling security features in the browser.

rest here




More in Tux Machines

Canonical Closes SQLite Vulnerabilities in All Supported Ubuntu OSes

Canonical has published details in a security notice about a number of SQLite vulnerabilities that have been found and fixed in Ubuntu 15.04, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS OSes. Read more

Fotoxx 15.08 Is a Free and Powerful Image Editor for Linux

Fotoxx, a free, open source Linux photo editing application that is useful both beginner and experts alike, has been upgraded to version 15.08 and is now available for download. Read more

Ubuntu MATE Projects Donates Money to Debian, MATE, and Syncthing Developers

The Ubuntu MATE project does something very admirable each month. Its makers contribute financially to other open source projects that are being used in the operating system, and that is something that doesn't happen all the often in the FOSS universe. Read more

Wine 1.7 Series Turn Two Years Old, No Sign Of Wine 1.8

Today marks two years since the start of the Wine 1.7 development series. While it's been two years of doing bi-weekly development releases, there's no sign of Wine 1.8.0 being ready for release in the near future. Read more