QID 198663

Extensions of a particular type could auto-updatethemselves and bypass the prompt that requests permissions.
Dragging and dropping an image into a folder couldresult in it being marked as executable.
Remote agent, used in webdriver, did not validatehost or origin headers.

Multiple security issues were discovered in firefox.
If a user weretricked into opening a specially crafted website, an attacker couldpotentially exploit these to cause a denial of service, bypass securityrestrictions, obtain sensitive information, or execute arbitrary code.
If a userwere tricked into installing a specially crafted extension, an attackercould potentially exploit this to bypass security restrictions.
If a user were tricked intodragging and dropping a specially crafted image, an attacker couldpotentially exploit this to execute arbitrary code.
If a user were tricked into opening a speciallycrafted website with webdriver enabled, an attacker could potentiallyexploit this to connect back to the user's browser in order to controlit.