Safari for Windows is less than 24 hours old and the Intarwebs are already circulating a serious exploit which allows a simple web page to launch an arbitrary local command with the security permissions of the current user -- which in Windows often means as Administrator. A strange combination of failed input validation and obsolete protocols (anyone old enough to remember gopher:// ?) allows an attacker to launch an application remotely as long as she has knowledge of the executable target's location on your hard drive.
|