The URI vulnerability was originally discovered as a "cross-browser" flaw in which an attacker could use a specially crafted internet address in Internet Explorer to launch Firefox without security protections and run malicious code.
Mozilla had pointed out the flaw in the 2.0.0.5 update, claiming that any further fixes would be the responsibility of Microsoft.
Following the 2.0.0.5 release, however, security researcher Jesper Johansson pointed out that the URI handler in Firefox remained just as vulnerable as Internet Explorer.
The problem, noted Johannson, was that Firefox did not properly format the URI address, allowing an attacker to potentially insert multiple malicious instructions.
In addition to fixing the way URI addresses are displayed, the 2.0.0.6 update also repairs a vulnerability that would allow an attacker escalate privileges through a specially crafted about:blank window. That vulnerability is listed as "moderate," the second of Mozilla's four alert levels.
No other security or performance fixes were included in the update.
.png&h=140&w=231&c=1&s=0)
.png&w=100&c=1&s=0)
Private AI vs Public AI: How your organisation can securely adopt AI without compromise and excessive cost
iTnews Benchmark Security Awards 2025
Digital Leadership Day Federal
Government Cyber Security Showcase Federal
Government Innovation Showcase Federal
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
