Firefox Releases Critical Patch Update to Stop Ongoing Zero-Day Attacks, and you need to update this right now.

Mozilla earlier today released Firefox 67.0.3 and Firefox ESR 60.7.1.  These versions are to patch a critical zero-day vulnerability in the browsing software. As a result, hackers have been found exploiting in the wild.

Discovered and reported by Samuel Groß, a cybersecurity researcher at Google Project Zero.  The vulnerability could allow attackers to remotely execute arbitrary code on machines running vulnerable Firefox versions and, take full control of them.

The vulnerability is identified as CVE-2019-11707.  And, affects anyone who uses Firefox on desktop Windows, macOS, and Linux.  Whereas, Firefox for Android, iOS, and Amazon Fire TV are not affected.

According to an advisory, the flaw has been labeled as a type confusion vulnerability in Firefox. As a result, there could be an exploitable crash due to issues in Array.pop; which can occur when manipulating JavaScript objects.

At the time of writing, neither the researcher nor Mozilla has yet released any further technical details or proof-of-concept for this flaw.

Through Firefox automatically installs latest updates and activate new version after a restart, users are still advised to ensure they are running the latest Firefox 67.0.3 and Firefox (Extended Support Release) 60.7.1 or later.


The researcher later today shared a few more details about the flaw with The Hacker News, saying the reported flaw primarily leads to Universal Cross-site Scripting (UXSS) attacks, but if combined with a sandbox escape issue, it could also allow attackers to execute arbitrary code remotely on targeted systems.

“I don’t have any insights into the active exploitation part. I found and then reported the bug on April 15. The first public fix then landed about a week ago (sec fixes are held back until close to the next release):” Groß said on Twitter.

“The bug can be exploited for RCE but would then need a separate sandbox escape. However, most likely, it can also be exploited for UXSS, which might be enough depending on the attacker’s goals.”

Read more here at The Hackers News

Leave a Comment

Recent Posts


Something went wrong. Please check your entries and try again.