PT update Netscape is testing patches for a newly discovered security hole in its Communicator Web browser that could expose private files. The vulnerability lets a hostile Web site glean private information from a visitor, including but not limited to that visitor's bookmarks. Netscape and the bug's discoverer agree that the problem isn't with any one aspect of Communicator, but with a combination of technologies that lets a malicious Web operator skirt browser security checks. Those security checks normally prevent Web authors using JavaScript from transferring information from a frame with the Web surfer's liberal security clearance to another frame belonging to the hostile Web site. JavaScript is a scripting language, designed by Netscape, that is used to prompt actions on a computer without a person's interaction.
Frames are smaller windows within windows on Web sites.
Computer users can use frames or full windows to access local files on their computer, which is why windows opened from the local disk have those liberal security restrictions. Cross-frame security checks are designed to protect those windows from being hijacked by hostile Web sites. Cookies are text files that Web sites use to store information about a visitor for future reference. Applications that rely on cookies include Web-based email applications, which use the technology to track how long a visitor has been logged into an account, and shopping carts, which keep track of items a shopper has opted to buy. Haselton said the exploit could be used to pilfer both bookmarks and cache information.