On Fri, 2016-12-16 at 14:38 -0800, Adam Williamson wrote:
Doesn't it mitigate the completely drive-by attack via Chrome
and
tracker metadata parsing, though? You can still exploit it, but not
so
seamlessly...right?
I think the attacker would win if the user ever visits his downloads
directory in nautilus (triggering the thumbnailer) before deleting the
file some other way. Still pretty bad.