Local cookie disclosure via world-readable jar

Information disclosure in NetSurf through 2.8 allows local users to read cookie contents via a world-readable cookie jar. The browser stores its cookie jar with permissions that permit other local accounts to read it, exposing session and tracking data without exploiting a network service. Local users need filesystem access to the host; the documented consequence is confidentiality loss only, with no integrity or availability impact reported.