Mozilla on Thursday acknowledged that a year-old vulnerability in the QuickTime media player plug-in for Firefox could let a hacker break into the open-source browser.