 Attack code for Firefox 16 privacy vulnerability now available online
Attack code for Firefox 16 privacy vulnerability now available online (updated)

          
          
"It appears that this vulnerability allows access to the full URL of an entry in the browser history, without actually having to know that full URL in advance," he told Ars. "In the proof of concept, you can see he's doing a regex match to grab the user's twitter username."
Update, Oct 12, 1:57 PDT: In an e-mail sent more than 24 hours after this article was published, a spokesman for Mozilla wrote: "The flaw allowed access to the URL of windows or frames to which the attacker has a reference only—generally the ones that the attacker opened. It does not access 'history', only what the browser is doing at that moment."
Jeff Williams, a web application security expert and CEO of Aspect Security, e-mailed Ars with additional analysis of the vulnerability.
"Looks like Firefox introduced a code change that allows a malicious webpage to run some JavaScript that can access the 'location' (the URL bar) of windows," he wrote. "So attackers can abuse this by using JavaScript to open other windows to protected websites. Then that JavaScript can access the URL and give it to the attacker. This should result in an 'Error: Permission denied' message, but FF16 allows it."
Williams continued:
"This is most effective when the attacker can find a website that redirects to a URL with something sensitive in it—like your Twitter username. So although it sounds like a history-stealing attack, it really isn't. It allows access to URL's that might contain sensitive information."
As of 11:25 California time Firefox 16.0.1 for desktops had been pushed out to computers belonging to several Ars employees. Readers who are still using Firefox versions 15.0.1 or 16 should expect the update to install in the next few hours. Those who don't want to wait can expedite the update by selecting Help from the menu and then selecting About Firefox. Version 16 should be eventually be available here, although at 11:25 that link was still pushing version 15.0.1. Mozilla has released Firefox 16.0.1 for Android on Google Play.
Story updated to add details about Firefox 16.0.1 and analysis from Jeff Williams.


          
                  