What the public record says
Mozilla credited me as the reporter for Bug 2067465, a Windows File Handling issue. The .searchConnector-ms extension was missing from sExecutableExts[] in xpcom/io/nsLocalFileCommon.cpp. That list drives Firefox's executable-file warning and the Application Reputation submission path.
Because the extension was absent, a downloaded search-connector file showed no “this file may harm your computer” warning and Firefox offered Open. Opening it handed the file to the Windows Search Connector install flow, which can register an attacker-controlled OpenSearch provider.
The issue is tracked as Bug 2067465 and received CVE-2026-109782. The related Firefox/Thunderbird advisory mapping also references CVE-2026-106016. Mozilla verified the fix in Firefox 157.0.1, Firefox ESR 153.5, and Firefox 159.
Not a missing file extension. The file had an extension; the extension was missing from Firefox's executable list.
How the check works
Firefox gates the executable warning on extension lists. On Windows, IsExecutable checks sExecutableExts[]; the same list feeds Application Reputation. If an extension is absent from both, it gets no protection at either tier. .search-ms and .library-ms were already covered; .searchConnector-ms was not.
Scope and fix
The original report also covered .msu and certificate formats (.pfx/.p12/.p7b/.p7c/.pem). Testing showed Windows gates unsigned .msu packages, so that item was dropped. Certificate formats moved to a separate AppRep-only bug. Mozilla narrowed this bug to .searchConnector-ms and added it to the executable list.
A follow-up (Bug 2075533) fixed the lowercase comparison so the new entry worked at runtime. The fix was then verified in Firefox 157.0.1, ESR 153.5, and Firefox 159.
Disclosure timeline
- Reported Bug 2067465 filed with the Windows extension-list gap.
- Narrowed Mozilla scopes the issue to .searchConnector-ms; .msu and certificate formats are split out.
- Fixed The patch lands; follow-up Bug 2075533 fixes case-insensitive matching.
- Verified Firefox 157.0.1, Firefox ESR 153.5, and Firefox 159.
Why it matters
A downloaded file that installs a search provider is not a memory-safety bug, but it changes browser state. It can add an attacker-controlled OpenSearch provider to Windows Search and influence where future searches go. That is a persistence and trust issue, not a single-click crash.
It also shows why extension lists need class parity: Firefox already warned on .search-ms and .library-ms, so leaving .searchConnector-ms out was an inconsistency in the same protection class.