description: Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
problem types: Windows programs that are not 'URL Handlers' are exposed to web content
affected:
{
product: Thunderbird
vendor: Mozilla
versions:
lessThan: 60.6, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox ESR
vendor: Mozilla
versions:
lessThan: 60.6, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 66, status: affected, version: unspecified, versionType: custom
}
