Risk: Informational
A vulnerability that may cause fully patched versions of Firefox to expose a user's private data has been confirmed by Mozilla's chief of security.
The bug resides in Firefox's chrome protocol scheme. Attackers may exploit this vulnerability in order to gain user information and then may be able to create a more malicious exploit.
Firefox's chrome package is usually restricted to a limited number of directories, but a vulnerability exisits in the way it handles escaped sequences. This may allow an attacker to escape these confines and access more sensitive parts of a user's computer.
Mozilla are currently working on patching the flaw and users are urged to protect themselves by using the NoScript extention.