EIP-2026-117634

This exploit leverages a race condition in Mozilla Firefox 3.5.3's download manager to replace a legitimate file with a malicious one by exhausting the filename suffix counter in the /tmp directory. The attack requires write access to /tmp and user interaction to trigger the 'Open with' option.