NOTICE: I really wonder why the Mozilla Foundation decided to release a serious security update on a friday night and to disclose the link to my proof-of-concept code so quickly. It wasn't intendet from my side to release this as a 0day exploit. Please complain to
security@mozilla.org if you disagree with their release policy. Sorry, no CVE candidate number yet for that reason.
The link tag allows to load a custom image as the icon for a website, displayed in the location bar and in the tab title.
By setting the href attribute of this tag to a javascript url, it is possible to call chrome functions and run arbitrary code without user interaction.
The example is cross platform: On Windows this example creates the file c:\booom.bat and launches it (opens a dos box with a dir command). On Linux (tested Fedora Core) and MacOSX the example creates the file ~/booom.txt or /booom.txt.
The non-windows examples are only roughly tested. Please don't complain if not working. I doubt every Mac user can write to root by default. You get full user rights with UniversalXPConnect, so everything else is just a matter of implementation time.
Run example (cross platform)