Why did Chrome and Firefox disallow file:/// links? I can imagine an iframe opening a local resource, but which resource is the scary one? They could have just disabled iframes to file:///? Ajax requests don't work because of the origin issue, which makes sense. Local links used to be a very useful tool for intranets with shared drive mappings.

Was there a known exploit or is this just a protective measure from a theoretical, not yet existent threat?

1 Answer 1


Remote and local file access don't mix. Remote sites should know absolutely nothing of what's on your hard drive, except what's carefully exposed in controlled ways, such as HTML5 local storage and cookies.

Anything that gets loaded into the DOM can be examined by scripting, which means that allowing file:/// inclusion would effectively give any remote site read access to all the files on your computer. Malicious sites could then levarage this hole to covertly steal secrets from you, which could then possibly lead to further exploitation.

  • 1
    If the html from example.com has an iframe to my gmail inbox, it still can't read it. So that's not the problem. The only issue I can think of would have to be some form of file:/// XSS. Maybe modern OS's have e.g. rm as a web page with get parameters? Oct 31, 2013 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .