IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Mozilla patches two Firefox zero-day vulnerabilities

Memory bugs fixed in Firefox desktop and mobile browsers along with Mozilla's Thunderbird client

Mozilla has fixed two memory-related vulnerabilities in its Firefox browser that hackers were exploiting in the wild.

The bugs are fixed in Firefox 97.0.2, Firefox for Android 97.3.0, and version 81.6.1 of Firefox Extended Support Release (ESR), which is an enterprise version of the browser. They also affect Firefox Focus, the Foundation's privacy-focused mobile browser, and its Thunderbird mail client. 

Related Resource

The secure cloud configuration imperative

The central role of cloud security posture management

The secure cloud configuration imperativeFree download

CVE-2022-26485 is a use-after-free bug, in which developers don't clear a pointer to a memory location after freeing that portion of memory.

That allows an attacker to use an error to hack the program. In this case, the bug lies with the implementation of Extensible Stylesheet Language Transformations (XSLT), which is a language for transforming XML documents into other document formats.

Removing an XSLT parameter during processing could lead to an exploit, Mozilla said. The National Vulnerability Database gives this bug a CVSS score of 9.8 (critical).

CVE-2022-26486 is also a use-after-free bug, this time in the WebGPU IPC Framework. WebGPU is a web API that lets the browser use the system's GPU for calculations and drawing complex images inside a web page. Unexpected input fed to the framework could allow an attacker to escape the sandbox designed to contain malicious activity, Mozilla's advisory warned. This bug got a CVSS score of 6.0 (medium).

Mozilla said that it had received reports of attacks in the wild exploiting both of these bugs. VulDB, a database that tracks and collates bug information, believes that an exploit of the WebGPU bug could fetch up to $25,000.

The Foundation attributed discovery of the bugs to researchers at Chinese security team Qihoo 360 ATA.

Mozilla has rushed to fix zero-day bugs in Firefox before. Two years ago it released patches for use-after-free vulnerabilities that it said attackers were exploiting in the wild.

Featured Resources

2023 Strategic roadmap for data security platform convergence

Capitalise on your data and share it securely using consolidated platforms

Free Download

The 3D trends report

Presenting one of the most exciting frontiers in visual culture

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

Leverage automated APM to accelerate CI/CD and boost application performance

Constant change to meet fast-evolving application functionality

Free Download

Most Popular

Warning issued over ransomware attacks targeting VMware ESXi servers globally
cyber attacks

Warning issued over ransomware attacks targeting VMware ESXi servers globally

6 Feb 2023
ION Trading reportedly pays LockBit ransom demands
ransomware

ION Trading reportedly pays LockBit ransom demands

6 Feb 2023
BT Group extends Kyndryl deal to migrate legacy mainframe apps to the cloud
Business strategy

BT Group extends Kyndryl deal to migrate legacy mainframe apps to the cloud

31 Jan 2023