A major vulnerability discovered by Mozilla lurking in an advertisement shown by a Russian news site could steal your files and upload them to a Ukrainian server without you ever knowing. The flaw exploits Firefox’s PDF viewer and the JavaScript context to inject a script that can search for and upload local files.