Historically, yes, browsers have treated the
file: scheme as one unique origin and the attack you describe would have been feasible.
But today, no, Chrome and Firefox enforce same-origin policies that restrict access between local files. (However, not all browsers do that. Most notably, Microsoft Edge still doesn't restrict read access between local files, as @dandavis has spotted.)
That is, when you open an HTML file at
file:///downloads/malicious.html in one of these browsers, a script in that document can not freely search the file system and send home sensitive files. However, the exact way how SOPs on the
file: scheme are implemented varies between browsers and it isn't really well documented - and there doesn't seem to be an established standard for it.
Mozilla has some (potentially outdated) details documented here:
Starting in Gecko 1.9 [Mozilla's browser engine], files are allowed to read only certain other files. Specifically, a file can read another file only if the parent directory of the originating file is an ancestor directory of the target file. Directories cannot be loaded this way, however.
For example, if you have a file
foo.html which accesses another file
bar.html and you have navigated to it from the file
index.html, the load will succeed only if
bar.html is either in the same directory as
index.html or in a directory contained within the same directory as
I couldn't find any relevant documentation for Chrome, but inter-file access seems to be completely locked down. E.g., Chrome didn't let me issue a cross-origin request for a
Failed to load
file:///tmp/malicious.html: Cross origin requests are only supported for protocol schemes:
Even trying to have a
file: document access the DOM of an iframe with the same URI failed:
Uncaught DOMException: Blocked a frame with origin "null" from accessing a cross-origin frame.
That said, opening untrusted HTML files locally is still more dangerous than loading them from a website. Although they may not be able to read all local files, they could still employ attacks such as XSSI (cross-site script inclusion) to make other local files potentially leak sensitive information.