Firefox ships default preferences in browser/app/profile/firefox.js that classify certain schemes as always-external and simultaneously mark them as safe to launch without a confirmation prompt. For the Usenet schemes, network.protocol-handler.external.news, network.protocol-handler.external.snews, and network.protocol-handler.external.nntp were set to true while the corresponding network.protocol-handler.warn-external.* preferences were set to false, so any news:, snews:, or nntp: URL was dispatched to the OS-registered handler with no user warning. The violated invariant is that Firefox should prompt before handing an unsupported scheme to an arbitrary external program, an invariant Firefox honors for most schemes but had explicitly disabled here. Because no trusted newsreader ships by default on most operating systems, an untrusted downloaded application could register itself as the news:/snews: handler and then be silently launched by a website.

The fix removes both the external.* and warn-external.* preference lines for these schemes, so they fall back to the default behavior in which Firefox asks the user for confirmation before invoking any external handler.

An attacker gains the ability to silently launch a previously downloaded, attacker-controlled application from web content, without the confirmation prompt that would normally alert the user. This occurs in the context of Firefox’s external-protocol dispatch on the user’s machine and requires that the user has already downloaded and run (or otherwise allowed to register) a malicious program that claims the news: or snews: scheme. The rated impact is moderate because it depends on that prior attacker-supplied handler registration rather than yielding launch of arbitrary code on its own.