Hackers steal files from SD card - Firefox Security for Andriod

"The issue has been marked as fixed with v24, which rolled out to the Play Store on September 17th. Sebastián is also preparing a full technical report to explain the vulnerability in much greater detail," AndroidPolice said

Users of devices running Google's Android and who browse the web using Firefox for Android may have to be careful – a flaw in Firefox can let hackers steal files from the SD (Secure Digital) card on the device.

Enthusiast site AndroidPolice.com cited the findings of researcher Sebastián Guerrero Selma, who posted a video showing the newly found vulnerability.

"If successfully exploited, the implications of the vulnerability could be disastrous. Naturally, access to files on the SD Card is a privacy issue and could be severe depending on what is stored there, including personal pictures and video, or data placed there by other applications," it said.
AndroidPolice.com said apps can usually place data in a separate location such as a private folder, but it noted the secured location for Firefox is accessible.

The exploit can occur if users visit a web page and install an app or open a locally stored HTML file containing a malicious snippet of Javascript.