Mozilla extensions: a security nightmare

Posted by Stefan Kanthak on Aug 05

Hi @ll,

Mozilla Thunderbird 38 and newer installs and activates per default
the ‘Lightning’ extension.

Since extensions live in the (Firefox and) Thunderbird profiles
(which are stored beneath %APPDATA% in Windows) and ‘Lightning’ comes
(at least for Windows) with a DLL and some Javascript, Thunderbird
with ‘Lightning’ violates one of the mandatory and basic requirements
of the now 20 year old “Designed for…

Leave a Reply