Firefox Focus Update: Mozilla Fixes Two Critical Vulnerabilities in Out-of-Band Security Patch

In a move to address security concerns, Mozilla has released an out-of-band update for Firefox, Firefox Focus, and Thunderbird, fixing two critical vulnerabilities that have been exploited by attackers in the wild. The patches aim to prevent potential attacks on millions of users who still rely on these popular browser tools.

Despite declining user numbers over the past decade, Firefox remains a widely used browser, with millions of users worldwide. Mozilla has chosen not to share more details about the vulnerabilities or the attacks, urging users to upgrade to the latest versions as soon as possible.

The two patched zero-days are memory corruption bugs of the 'use-after-free' kind, which can allow attackers to use memory that has been freed by the program. CVE-2022-26485 affects XSLT parameter processing and can be exploited to achieve remote code execution within the context of the application. Meanwhile, CVE-2022-26486 affects the WebGPU IPC Framework and enables attackers to perform a sandbox escape.

The vulnerabilities were reported by Wang Gang, Liu Jialei, Du Sihang, Huang Yi & Yang Kang of 360 ATA, leading many to assume that they are being used together to compromise machines remotely and allow malware to escape the application's security sandbox. Mozilla has urged users to update their browsers immediately to prevent potential attacks.

The out-of-band security patch is a crucial step towards ensuring the safety and security of Firefox, Firefox Focus, and Thunderbird users. With this update, Mozilla aims to provide an added layer of protection against emerging threats in the digital landscape.

In conclusion, the recent Firefox focus update is a significant move by Mozilla to address two critical vulnerabilities that could put millions of users at risk. The out-of-band security patch underscores the importance of staying up-to-date with browser updates and prioritizing online safety.