Remote exploit released for brand-new Safari for Windows

Security researcher Thor Larholm has found what might be the first remote code execution vulnerability in Apple's shiny new Safari for Windows. Larholm (left) has released an advisory with proof-of-concept code to demo the vulnerability, which can be used to take complete control of a Windows PC if the user simply surfs to a Web page. Click here for a demo of the flaw, which triggers a Safari crash and bounces through Firefox via the Gopher protocol. Larholm explains: The logic behind this vulnerability is quite simple and the vulnerability class has been known and understood for years, namely that of protocol handler command injection. A browser typically consists of a multitude of different URL schemes, some of which are...