News for hackers. Stuff that matters.

A comment on Firefox about:config Menu Shortcut. Parent comment

Re:Firefox about:config Menu Shortcut by gruez on Tuesday January 25, 2022 @08:00AM (#30071276)
What are the "security enhancements" that those users are missing out on?
[ Parent | on HN ]
Re:Firefox about:config Menu Shortcut by roblabla on Tuesday January 25, 2022 @08:22AM (#30071471)
Essentially, it allows calling eval[1] and executing "privileged loads"[0] in some elevated contexts (the System Principal, which is responsible for the browser UI[2]).

Those are useful mitigations, but disabling them for some custom user-chrome is unlikely to have a meaningful impact on your browser's security.

[0] https://searchfox.org/mozilla-central/source/dom/security/ns...

[1] https://searchfox.org/mozilla-central/source/dom/security/ns...

[2]: https://blog.mozilla.org/attack-and-defense/2020/06/10/under...

[ Parent | on HN ]
Re:Firefox about:config Menu Shortcut by nix0n on Tuesday January 25, 2022 @08:15AM (#30071404)
First one I found was blocking of eval()

https://searchfox.org/mozilla-central/source/dom/security/ns...

[ Parent | on HN ]
Re:Firefox about:config Menu Shortcut by bugmen0t on Tuesday January 25, 2022 @08:54AM (#30071769)
As pointed out by sibling-comments, this seems to be in the context of making sandbox escapes harder.
[ Parent | on HN ]