Mozilla Firefox and Thunderbird jar: URL Content Interpretation Vulnerability

A vulnerability exists in Firefox versions prior to 136, Firefox ESR versions prior to 128.8, Thunderbird versions prior to 136, and Thunderbird ESR versions prior to 128.8. This vulnerability involves jar: URLs, which retrieve local file content packaged in a ZIP archive. The null character and everything following it were ignored when accessing the archive's contents, but the fake extension added after the null was used to determine the type of content. This could have allowed code in a web extension to be concealed as something innocuous, like an image.

Impact

Exploitation of this vulnerability could have led to the execution of hidden code within a web extension, potentially causing harm to the user or their system.

Remediation

Users can update to Firefox 136, Firefox ESR 128.8, Thunderbird 136, or Thunderbird ESR 128.8 to address this vulnerability.