Firefox's JAR protocol handler flaw is finally getting some attention after nine months on Bugzilla when a security researcher produced a proof-of-concept hack using GMail.

"Attackers can exploit the flaw by uploading any content -- malicious code, for example, or a malformed Office document -- to a Web site, then entice users to that site and its content with a link that includes the jar: protocol. Because the content executes in the security context of the hosting site, if that site (eg., a commercial photo sharing service) is trusted, then the malicious code runs as trusted within the browser too."