on october 8th , the javascript team released a configuration change which resolves this problem by specifically disabling the users of the shell : an external protocol handler .
A shell is an external protocol handler.