According to http://mftbug.surge.sh [ed note: potentially dangerous link on the page], any web page can attack a user through the browser without knowledge about the user. How can we stop this default behavior?


In answer to the question there is no global way to stop access to local files for ALL browsers via the address bar or via a web link.

You may though be able to block these links via your AV or anti malware software. As many have black list style options.

With IE, as it is Windows based, there may be ways to edit the registry or by using Local Group Policy.

A small caution note. By blocking local file access it may cause some minor usability issues. Such as downloading a PDF and trying to then run it in a browser (for example chrome).


How can we stop this default behavior?

Install and use Firefox or Chrome, instead of using a brain-damaged browser that allowed this behaviour. Firefox and Chrome by default doesn't allow embedding file:// links from pages in http:// or https:// context.


The site in your post contains a 'link of death' as an image source. This variation of the bug uses $MFT, the NTFS Master File Table.
If you access $MFT as a directory ( file:///C:/$mft/123 ) the system hangs.

You can take a number of steps to protect yourself from browser based attacks.

  • Keep your browser and system updated
  • Use an antivirus and keep it updated
  • Tighten your browser's security settings
  • Disable js or use NoScript

Ultimately the best defence against browser attacks is user awareness.

  • please do not provide link-only answers - provide the relevant parts of the link in your answer
    – schroeder
    May 28 '17 at 12:59
  • @schroeder my main concern was the link on OP's question. I 'll edit my post.
    – t.m.adam
    May 28 '17 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.