Why is the javascript: pseudo protocol still a wide-open attack vector? Is it because of the potential for beneficial bookmarklets? It feels like there's a new attack on major sites every day.
- Found the following issue for Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=305692
- Found the following issue for Chrome: http://code.google.com/p/chromium/issues/detail?id=6888
Ctrl+C,Alt+D,Ctrl+V,Home,j-a-v-a-s-c-r-i-p-t-:,Enter!
I guess if you can convince people that you have something they want, you can make them do almost anything to their poor browser :(