@domubpkm There is a security issue, but it's relatively minor and manageable. The problem lies in JavaScript files with privileged execution that can access browser internals and read files on the host. However, the risk is mitigated by the fact that:
- Librewolf stores sessions in cache, so malicious code would only execute in the next session (after restart)
- The sensitive files are re-read and replaced every time a session is launched, making it difficult for changes to persist
- The time window for tampering with the files is small (between verification of the Chrome folder and Librewolf launch)
To further reduce the risk, encryption and obfuscation of the sensitive files could be implemented, but this would make it harder for me (the developer) to test and debug code. The issue will be addressed once the more significant problems are resolved.
It's worth noting that Librewolf is considered a secure browser, and the privileged code execution is heavily sandboxed, preventing access to web content among other things. While this issue could potentially be exploited to steal data, the overall security of the browser is still robust, and any other security problems would likely originate from the Librewolf/Firefox source code itself.
