The URI vulnerability was originally discovered as a "cross-browser" flaw in which an attacker could use a specially crafted internet address in Internet Explorer to launch Firefox without security protections and run malicious code.
Mozilla had pointed out the flaw in the 2.0.0.5 update, claiming that any further fixes would be the responsibility of Microsoft.
Following the 2.0.0.5 release, however, security researcher Jesper Johansson pointed out that the URI handler in Firefox remained just as vulnerable as Internet Explorer.
The problem, noted Johannson, was that Firefox did not properly format the URI address, allowing an attacker to potentially insert multiple malicious instructions.
In addition to fixing the way URI addresses are displayed, the 2.0.0.6 update also repairs a vulnerability that would allow an attacker escalate privileges through a specially crafted about:blank window. That vulnerability is listed as "moderate," the second of Mozilla's four alert levels.
No other security or performance fixes were included in the update.
.png&h=140&w=231&c=1&s=0)
.png&h=140&w=231&c=1&s=0)
_page-0001.jpg&w=100&c=1&s=0)
Integrate Expo 2025
.png&w=120&c=1&s=0)
Security Exhibition & Conference 2025
Digital As Usual Cybersecurity Roadshow: Brisbane edition
iTnews Benchmark Security Awards 2025
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
