NoScript and other popular Firefox add-ons open millions to new attack

[Chiefcrowe]

http://arstechnica.com/security/201...r-firefox-add-ons-open-millions-to-new-attack

 

[MustISO]

Read this the other day, really sucks.

 

[bononos]

The vulnerability still needs a malicious extension to be installed. Not huge problem for people who only install the bare minimum like https everywhere, ublock, noscript, MAF. But many people don't realize malware/privacy implications of installing browser extensions.

 

[VirtualLarry]

Wow. Not too surprising though. JavaScript itself wasn't exactly designed with high security in mind.

Couldn't they introduce some sort of JS private namespace for each extension, and it would require explicitly importing the namespaces of functions and variables that it accesses, so that this sort of cross-extension programming could be more easily detected and controlled?

Or would that require too much of a revision to JavaScript's functionality itself?

 

[John Connor]

Wouldn't Sandboxie prevent this?

Hope CrossFire gets deployed.