Firefox Popup Blocker has security hole

The vulnerability allows an attacker to read arbitrary user-accessible files on the system, and could help them steal some fairly sensitive information.

Writing here, Zalewski said that the problem seems to affect Firefox version 1.5.0.9.

For security reasons, Firefox does not allow Internet-originating websites to access the file:// namespace. When a user allows a blocked popup normal URL, permission checks are bypassed.

All it takes is for the attacker may fool the browser to parse a chosen HTML document stored on the local filesystem. Firefox security manager treats all file:/// URLs as having "same origin", such a document could read other local files at its discretion with the use of XMLHttpRequest, and relay that information to a remote server.

More here. µ