Why did Chrome and Firefox disallow
file:/// links? I can imagine an iframe opening a local resource, but which resource is the scary one? They could have just disabled iframes to
file:///? Ajax requests don't work because of the origin issue, which makes sense. Local links used to be a very useful tool for intranets with shared drive mappings.
Was there a known exploit or is this just a protective measure from a theoretical, not yet existent threat?