A French security testing company has found two holes in the latest version of Firefox that it rates as 'critical'.

The vulnerabilities could allow hackers to implant code in a web page that would create a batch/exe file with a malicious payload such as a Trojan or key-logger on the PC of anyone viewing the site, warned testers at the French Security Incident Response Team (FrSIRT).

"The Mozilla Foundation partially patched this issue on the server side by adding random letters and numbers to the install function, which will prevent this exploit from working," said FrSIRT, which posted the alert on Saturday.

FrSIRT rates the flaws as critical and has posted proof-of-concept exploit code on its website.

The Mozilla Foundation said in a statement: "Mozilla is aggressively working to provide a more comprehensive solution to these potential vulnerabilities and will provide that solution in a forthcoming security update.

"Users can further protect themselves today by temporarily disabling JavaScript or disabling the 'Allow websites to install software' option in Tools > Options > Web Features."