Advanced

Sites can slurp browser history right out of Firefox 16

Posted by vagabondo on · 6 comments
The Register; By Anna Leach 		Mail this story
Print this story

A hole in Firefox 16 makes it possible for a malicious site to access a user's browsing history, Mozilla security chief Michael Coates revealed in a blog yesterday. Mozilla 16 was released on Tuesday but pulled a day later because of the vulnerability which would allow a hacker to suck out URLs from the browser history of a visitor of a malicious page.

A hole in Firefox 16 makes it possible for a malicious site to access a user's browsing history, Mozilla security chief Michael Coates revealed in a blog yesterday.

Coates promised a patch today for the vulnerability in the latest version of the browser.

Mozilla 16 was released on Tuesday but pulled a day later because of the vulnerability which would allow a hacker to suck out URLs from the browser history of a visitor of a malicious page.

There was no indication that the weakness was being exploited in the wild said Coates. Users on Firefox 15 are unaffected.

Mozilla-users who don't want to wait for the patch today can downgrade to Firefox 15.0.1 until the clean version of 16 is ready. ®

Full Story

  Nav
» Read more about: Story Type: News Story; Groups: Mozilla

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (6)

BernardSwiss ·
I thought it could just examine URLs currently being visited.
tracyanne ·
Whatever, I just set up the Mozilla security updates ppa, and upgraded to the fix.
djohnston ·
Mozilla has already issued a fix in the form of version 16.0.1.

Firefox 16 re-released fixing multiple vulnerabilities

caitlyn ·
SalixOS pushed 16.0.1 yesterday as did openSUSE.
jdixon ·
The Slackware changelog:

Thu Oct 11 21:25:20 UTC 2012

xap/mozilla-firefox-16.0.1-i486-1.txz: Upgraded. This update fixes a security vulnerability that could allow a malicious site to potentially determine which websites users have visited and have access to the URL or URL parameters. (* Security fix *)

xap/mozilla-thunderbird-16.0.1-i486-1.txz: Upgraded. This release contains security fixes and improvements. For more information, see: http://www.mozilla.org/security/known-vulnerabilities/thunde... (* Security fix *)
caitlyn ·
I still think the Mozilla six week release cycle is beyond insane and guarantees more serious problems like this.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post