Firefox versions prior to 130 and ESR versions prior to 128.2 and 115.15 did not prompt users before opening external applications for the Usenet-related schemes news: and snews:. This behavior could allow a maliciously registered application to be launched without user consent when a user visits a website that triggers such a link. Most operating systems do not have a trusted newsreader installed by default, increasing the risk that a malicious program could register as the handler and be launched unexpectedly.