Two actively exploited Zero-Day vulnerabilities discovered in Mozilla Firefox

For a detailed advisory, download the pdf file here

Two critical zero-day vulnerabilities have been identified in Mozilla Firefox that are being exploited in-the-wild and tracked as CVE-2022-26485 and CVE-2022-26485. Both are use-after-free bugs that exist in XSLT parameter processing and the WebGPU IPC Framework, respectively. Attackers can exploit these flaws to cause the sandbox escape or execute arbitrary code on the affected machine.

Several controls have been introduced in recent browsers that make exploitation of these Use-after-free vulnerabilities much harder but despite this, they still seem to persist. This is a weakness related to the incorrect use of dynamic memory during program operation. Successful exploitation of this issue may lead to data corruption, program crash or arbitrary code execution.

These vulnerabilities have been fixed in versions Firefox 97.0.2, Thunderbird 91.6.2 and Firefox ESR 91.6.1

Potential MITRE ATT&CK TTPs are:

TA0001: Initial Access

TA0040: Impact

TA0004: Privilege Escalation

T1068: Exploitation for Privilege Escalation

T1499: Endpoint Denial of Service

T1189: Drive-by Compromise

T1190: Exploit-public facing application

Vulnerability Detail

Patch Link