Web browsers are the singular portal to all the internet has to offer, and are clearly an indispensable tool to access the World Wide Web. Without a web browser running on an operating system, there would be no way for all the world’s netizens to interact with each other, the vast amounts of data and media online, as well as the online knowledge base. As much as web browsers are fundamental to modern computing for business needs and entertainment, they also experience their own shortcomings. Web browsers themselves are, at their core, a compilation of software written by developers working or contracting with software vendors. This also translates to the fact that browser software can be vulnerable to security flaws. Some of the most well-known web browsers in use today are Google Chrome and Mozilla Firefox, which have had their fair share of issues in the recent past.
With regards to Mozilla Firefox, recent security reports have revealed multiple software issues. Specifically, multiple software vulnerabilities have been discovered in the very widely used Mozilla Firefox web browser software. The issue is that these security flaws found by developers cause crashes, UI spoofs, and a possibility for a remote attacker to compromise a vulnerable system via an unpatched version of Mozilla Firefox.
The Mozilla Firefox Software Vulnerability
On September 7th, 2021 there were three Security Advisory release reports posted on the official Mozilla website concerning software vulnerabilities in certain versions of Mozilla Firefox (release one, release two, release three.) The Security Advisories revealed information that four software vulnerabilities were classified as high-risk.
In-Depth Security Analysis
The CVE (Common Vulnerabilities and Exposures) ID database codes for the high-risk vulnerabilities affecting Mozilla Firefox discussed in the Security Advisory releases are as follows; CVE-2021-29993, CVE-2021-38493, CVE-2021-38494, CVE-2021-38495.
CVE-2021-29993
Vulnerability type: Handling custom intents could lead to crashes and UI spoofs.
Mozilla Firefox for Android allowed navigations through the intent:// protocol, which could be used to cause crashes and UI spoofs. This vulnerability only affects Firefox for Android, and other operating systems are unaffected.
CVE-2021-38493
Vulnerability type: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14, and Firefox ESR 91.1. Mozilla developers Gabriele Svelto and Tyson Smith reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and it is presumed that with enough effort some of these could have been exploited to run arbitrary code. The vulnerable software versions are Firefox 92, Firefox ESR 78.14, and Firefox ESR 91.1.
CVE-2021-38494
Vulnerability type: Memory safety bugs fixed in Firefox 92. Mozilla developers Christian Holler and Lars T Hansen reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and it is presumed that with enough effort some of these could have been exploited to run arbitrary code. The vulnerable software version is Firefox 92.
CVE-2021-38495
Vulnerability type: Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1. Mozilla developers Tyson Smith, Christian Holler, and Gabriele Svelto reported memory safety bugs present in Firefox 91 and Firefox ESR 91.0. Some of these bugs showed evidence of memory corruption and it is presumed that with enough effort some of these could have been exploited to run arbitrary code. The vulnerable software versions are Firefox 92 and Firefox ESR 91.1.
Safety Recommendations For Users of Mozilla Firefox
For all of the above software vulnerabilities, it is recommended that users immediately update Firefox across all of their devices (laptops, tablets, or smartphones.) The updates should occur automatically and users should be informed with a system notification. Alternatively, users should consult the Mozilla support web page for further assistance on how to update Firefox to the latest release.
