Netscape Navigator 'about:' Domain Information Disclosure Vulnerability

Due to a flaw in Navigator's security code, all URLs in the about: protocol are considered to be part of the same domain.

If arbitrary Javascript code is placed in a GIF's comment field, it is treated like a normal HTML page. The Javascript code will run from the image information page in the internal about: 'domain'. This issue has also been reported in commented JPEG files.


 

Privacy Statement
Copyright 2010, SecurityFocus