Does this spoof effect you with Mozilla Firefox 0.9.3???  

28 members have voted

  1. 1. Does this spoof effect you with Mozilla Firefox 0.9.3???

    • yes
      16
    • no
      12


Recommended Posts

I installed Mozilla Firefox 0.9.3 earlier today and then later on just for the fun of it I decided to check to see if the vulnerability still effected me... strangly it does...

I was wondering if anyone else with Mozilla Firefox 0.9.3 is still being effected. link is below.

http://www.nd.edu/~jsmith30/xul/test/spoof.html

I think Firefox should have followed IE's lead in making the content area sunken into the browser window. It allows you to tell whether something is part of the browser window or not regardless of whether anything is spoofed.

https://www.neowin.net/forum/index.php?showtopic=192796

but it has been fixed in the nightly branch build I'm using since August 03.

Yup, it throws up

XML Parsing Error: undefined entity

Location: http://www.nd.edu/~jsmith30/xul/test/browser2.xul

Line Number 856, Column 36:              <menuitem accesskey="&releaseCmd.accesskey;"

-----------------------------------^

As far as I'm concerned, I can find no evidence to say that this was supposed to be in 0.9.3 at all... unless you can give a source which directly quotes a developer stating that, please stop spreading rubbish about a "messed up" release. Four security bugs were fixed with 0.9.3, and if you check the thread already linked, you'll see why I don't even consider this an exploit.

Kasteo, I'd be interested to know what build you're using, since I can't think of a fix for this at all, short of forcing the legitimate statusbar to display for XUL content (i.e. prevent popups disabling it), nor can I find any checkins or bugfixes to indicate that any change has been made in relation to this "bug" at all.

...

Kasteo, I'd be interested to know what build you're using, since I can't think of a fix for this at all, short of forcing the legitimate statusbar to display for XUL content (i.e. prevent popups disabling it), nor can I find any checkins or bugfixes to indicate that any change has been made in relation to this "bug" at all.

Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.7) Gecko/20040804 Firefox/0.9.1+

When you click on the example of an exploit XUL content link it will show....

XML Parsing Error: undefined entity
Location: http://www.nd.edu/~jsmith30/xul/test/browser2.xul
Line Number 856, Column 36:              &lt;menuitem accesskey="&amp;releaseCmd.accesskey;"
-----------------------------------^

I still see the spoof, but because of the way I have the browser configured, I'd never be fooled by it.. it's so vastly different looking from the way I have mine configured not to mention I have disabled the ability for javascript to hide things.

Still, it should be addressed. It's still in beta and in a constant state of change as bugs get fixed, so I'll give them a bit of time yet.. I just wish the gecko engine loaded images faster.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Microsoft released Windows 11 KB5094149 / KB5095971 / KB5094156 Setup, Recovery updates by Sayan Sen Earlier this week Microsoft released its newest Patch Tuesday updates (KB5094126 / KB5093998 on Windows 11 and KB5094127 on Windows 10). Alongside those, Microsoft also released new dynamic updates. These Dynamic Update packages are meant to be applied to existing Windows images prior to their deployment. Dynamic Updates also help preserve Language Pack (LP) and Features on Demand (FODs) content during the upgrade process. VBScript, for example, is currently an FOD on Windows 11 24H2. This time both recovery and setup updates were released for Windows 11 as well as Windows 10. The company writes: "KB5095185: Safe OS Dynamic Update for Windows 11, version 26H1: June 9, 2026 This update makes improvements to the Windows recovery environment (WinRE). After installing this update, the WinRE version installed on the device should be 10.0.28000.2269. KB5094149: Safe OS Dynamic Update for Windows 11, versions 24H2 and 25H2: June 9, 2026 This update makes improvements to the Windows recovery environment (WinRE). After installing this update, the WinRE version installed on the device should be 10.0.26100.8655 KB5095971: Setup Dynamic Update for Windows 11, version 23H2: June 9, 2026 This update makes improvements to Windows setup binaries or any files that setup uses for feature updates in Windows 11, version 23H2. KB5094156: Safe OS Dynamic Update for Windows 11, version 23H2: June 9, 2026 This update makes improvements to the Windows recovery environment (WinRE). After installing this update, the WinRE version installed on the device should be 10.0.22621.7219 KB5098815: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: June 9, 2026 This update automatically applies Safe OS Dynamic Update (KB5094154) to the Windows Recovery Environment (WinRE) on a running PC. The update installs improvements to Windows recovery features. KB5094154: Safe OS Dynamic Update for Windows 10, versions 21H2 and 22H2: June 9, 2026 This update makes improvements to the Windows recovery environment (WinRE). After installing this update, the WinRE version installed on the device should be 10.0.19041.7417. KB5094153: Safe OS Dynamic Update for Windows 10, version 1809 and Windows Server 2019: June 9, 2026 This update makes improvements to the Windows recovery environment (WinRE). After installing this update, the WinRE version installed on the device should be 10.0.17763.8880. KB5094152: Safe OS Dynamic Update for Windows 10, version 1607 and Windows Server 2016: June 9, 2026 This update makes improvements to the Windows recovery environment (WinRE). After installing this update, the WinRE version installed on the device should be 10.0.14393.9234." Microsoft notes that both the Recovery and Setup updates will be downloaded and installed automatically via the Windows Update channel.
    • Quantum Error Correction Validated in Nature: Microsoft and Quantinuum Log 800-Fold Improvement Two years after the original press-release announcement, independently peer-reviewed results published in Nature on June 10, 2026, have confirmed that Microsoft and Quantinuum achieved an 800-fold reduction in quantum error rates on real trapped-ion hardware — the largest gap between physical and logical error rates ever independently validated.    What Quantum Error Correction Actually Does — and Why Breaking Even Is Hard https://www.techtimes.com/articles/318329/20260613/quantum-error-correction-validated-nature-microsoft-quantinuum-log-800-fold-improvement.htm   Quantum Computing Wiring Bottleneck Cracked by HKU Silicon Carbide Chip at Qubit Temperature Engineers at the University of Hong Kong have built the first cryogenic control chip that operates at the same temperature as superconducting qubits — 10 millikelvin, or just one-hundredth of a degree above absolute zero — without generating the heat that has forced every competing approach to park its electronics hundreds of meters of cable away. https://www.techtimes.com/articles/318325/20260613/quantum-computing-wiring-bottleneck-cracked-hku-silicon-carbide-chip-qubit-temperature.htm  
    • RevPDF 4.5.0 by Razvan Serea RevPDF is a free, fully offline PDF editor for Windows, macOS, and Linux that lets you edit text and images directly inside PDF files — no internet connection, no account, and no cloud uploads required. Unlike bloated alternatives that demand subscriptions and constant connectivity, RevPDF fits in under 60MB on desktop while delivering a complete editing toolkit: annotate, redact, sign, compress, split, merge, convert, and reorganize pages, all processed locally on your device. Smart font matching ensures edited text blends seamlessly with the original, and multi-language support includes RTL scripts such as Arabic and Hebrew. Where most PDF editors force you to choose between features and simplicity, RevPDF manages both. You can build interactive forms from scratch with text fields, checkboxes, and dropdowns, permanently redact sensitive data before sharing, draw freehand on contracts and diagrams, and add custom watermarks — all without a single file leaving your machine. Edit Text and Images Directly Inside PDFs RevPDF supports true inline PDF editing — not just annotation layers on top of a document, but actual modification of existing text and images within the file. A smart font-matching engine identifies the font used in the original document and applies it automatically when you make edits, so changes blend naturally with the surrounding content. You can reposition elements, resize images, and update text across single pages or entire documents. RevPDF 4.5.0 release notes: This is one of the biggest updates to RevPDF yet. A lot of things people have been asking for are finally here. New Features Auto Redaction Permanently redact sensitive text and areas from your PDFs before sharing. Clean, irreversible, and fully offline. Comments, Links & Bookmarks Add comments for review, insert clickable links, and create bookmarks to jump around long documents without scrolling forever. Find & Replace Search across the whole document and replace text in one go. Long overdue. Split Pages Vertically or Horizontally Split any page down the middle, vertically or horizontally. Perfect for scanned books or double-page spreads. New Drawing Tools More tools for freehand drawing and markup, better for annotations, sketches, and detailed notes. Continuous Scrolling in Editor The editor now scrolls continuously through pages instead of jumping between them. Working through long documents is a lot smoother now. PDF Metadata Editor View and edit the metadata stored inside your PDFs, including title, author, subject, and keywords. Better Font Matching Text edits now blend in more naturally by doing a better job of matching the original font. Tabbed PDF Viewer Open multiple PDFs at once in tabs and switch between them without going back to the home screen. Add Links Insert hyperlinks anywhere in your PDF, to external URLs or to other pages within the document. Share & Print Shortcuts Share or print directly from the editing screen, home screen, and viewer. No extra steps. Minor Updates Paste images directly from clipboard into your PDF New image editing tools for more control over images inside documents Bug Fixes Fixed file saving issues on Windows and Linux Everything still works fully offline. No login, no cloud, no account. Your files stay on your device. Download: RevPDF 4.5.0 | 58.0 MB (Open Source) Links: RevPDF Home Page | Github | Screenshots 1 | 2 Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Interesting. I'm not using a VPN with my phone. I tried though my home internet (Rogers) and my cellular internet (Telus) using their respective DNS servers and both trigger the dialog above.
    • Three days after Anthropic launched Claude Fable 5 as the most capable AI model it had ever released to the public, the United States government ordered it switched off — and now the company is refunding customers who paid to use a product that vanished almost overnight https://www.techtimes.com/articles/318342/20260613/us-government-pulls-anthropics-fable-5-offline-now-come-refunds-vanished-ai.htm  
  • Recent Achievements

    • Week One Done
      agatameier earned a badge
      Week One Done
    • One Month Later
      agatameier earned a badge
      One Month Later
    • Week One Done
      ssd21345 earned a badge
      Week One Done
    • Contributor
      MarkHughes4096 went up a rank
      Contributor
    • Dedicated
      jordanspringer earned a badge
      Dedicated
  • Popular Contributors

    1. 1
      +primortal
      507
    2. 2
      +Edouard
      175
    3. 3
      PsYcHoKiLLa
      139
    4. 4
      ATLien_0
      91
    5. 5
      Steven P.
      76
  • Tell a friend

    Love Neowin? Tell a friend!