Firefox exploit found in the wild
I don't even want my browser to have a 'local file context', is there a way to switch such behavior off entirely until explicit permission is given?All these extra bells and whistles added to browsers to allow websites to pretend they're 'native apps' should require a very large switch to be thrown from 'safe' to 'unsafe' whenever an application requests such a thing. And what a pdf reader has to do with javascript is a mystery as well. Systems that are too complex are almost by definition insecure.