http://mftbug.surge.sh [ed note: potentially dangerous link on the page], any web page can attack a user through the browser without knowledge about the user. How can we stop this default behavior?
In answer to the question there is no global way to stop access to local files for ALL browsers via the address bar or via a web link.
You may though be able to block these links via your AV or anti malware software. As many have black list style options.
With IE, as it is Windows based, there may be ways to edit the registry or by using Local Group Policy.
A small caution note. By blocking local file access it may cause some minor usability issues. Such as downloading a PDF and trying to then run it in a browser (for example chrome).
The site in your post contains a 'link of death' as an image source. This variation of the bug uses $MFT, the NTFS Master File Table.
If you access $MFT as a directory ( file:///C:/$mft/123 ) the system hangs.
You can take a number of steps to protect yourself from browser based attacks.
- Keep your browser and system updated
- Use an antivirus and keep it updated
- Tighten your browser's security settings
- Disable js or use NoScript
Ultimately the best defence against browser attacks is user awareness.