Top 10 winner

Firefoxurl URI Handler Flaw

Billy (BK) Rios · xs-sniper.com · 17 July 2007

Installing Firefox registers the firefoxurl: handler in the Windows registry, and IE passes unsanitised parameters to it, letting a web page run arbitrary commands. Rios argues the fault belongs to both products and shows the same pattern in Netscape Navigator and Trillian, crediting Larholm's original Safari exploit.

Record

Researcher

Billy (BK) Rios

Published by

xs-sniper.com

Date

17 July 2007

Topic

Browser

In the archive

• Ranked #6 in the 2007 Top 10 Web Hacking Techniques

Related sources

• Internet Explorer URI-handler exploit

Tags

• rce
• url-parsing
• command-injection
• filter-bypass
• attack-chain
• prior-art-extension
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Billy (BK) Rios, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.