News for hackers. Stuff that matters.

A comment on Firefox about:config Menu Shortcut. Parent comment

Re:Firefox about:config Menu Shortcut by bugmen0t on Tuesday January 25, 2022 @07:47AM (#30071169)
There are security checks for detecting userChrome.js. My understanding is that Firefox is going to let people customize as before but just not enable some security enhancements for those users. https://searchfox.org/mozilla-central/rev/02bd3e02b72d431f2c...
[ Parent | on HN ]
Re:Firefox about:config Menu Shortcut by gruez on Tuesday January 25, 2022 @08:00AM (#30071276)
What are the "security enhancements" that those users are missing out on?
[ Parent | on HN ]
Re:Firefox about:config Menu Shortcut by roblabla on Tuesday January 25, 2022 @08:22AM (#30071471)
Essentially, it allows calling eval[1] and executing "privileged loads"[0] in some elevated contexts (the System Principal, which is responsible for the browser UI[2]).

Those are useful mitigations, but disabling them for some custom user-chrome is unlikely to have a meaningful impact on your browser's security.

[0] https://searchfox.org/mozilla-central/source/dom/security/ns...

[1] https://searchfox.org/mozilla-central/source/dom/security/ns...

[2]: https://blog.mozilla.org/attack-and-defense/2020/06/10/under...

[ Parent | on HN ]
Re:Firefox about:config Menu Shortcut by nix0n on Tuesday January 25, 2022 @08:15AM (#30071404)
First one I found was blocking of eval()

https://searchfox.org/mozilla-central/source/dom/security/ns...

[ Parent | on HN ]
Re:Firefox about:config Menu Shortcut by bugmen0t on Tuesday January 25, 2022 @08:54AM (#30071769)
As pointed out by sibling-comments, this seems to be in the context of making sandbox escapes harder.
[ Parent | on HN ]