Disallowed file creation via extension sanitization mismatch

Filename restriction bypass in Mozilla Firefox before 127, Firefox ESR before 115.12, and Thunderbird before 115.12 lets attackers save .url files. The Save As path replaces invalid extension characters with spaces, but nsFilePicker.cpp strips that whitespace and lets Windows reinterpret the filename as a blocked extension. A victim must choose Save As on Windows 10 and later open the saved file from its folder; the browser does not execute it directly.