A vulnerability in the chrome protocol scheme allows directory traversal when a “flat” add-on is present resulting in potential information disclosure.
When a chrome package is “flat” rather than contained in a .jar the directory traversal allows escaping the extensions directory and reading files in a predictable location on the disk. Many add-ons are packaged in this way.
A visited attacking page is able to load images, scripts, or stylesheets from known locations on the disk. Attackers may use this method to detect the presence of files which may give an attacker information about which applications are installed. This information may be used to profile the system for a different kind of attack.
Users are only at risk if they have one of the “flat” packaged add-on installed. Examples of popular add-ons that are vulnerable include: Download Statusbar and Greasemonkey.
Mozilla is currently investigating this information disclosure issue and has assigned it an initial severity rating of low. Details are available at: https://bugzilla.mozilla.org/show_bug.cgi?id=413250
Gerry Eisenhaur first posted details of this issue along with proof of concept code at http://www.hiredhacker.com/2008/01/19/firefox-chrome-url-handling-directory-traversal/.