Firefox Exploited in seconds at PWN2OWN
Share this:
Mozilla Firefox has been hacked at lighting speed in PWN2OWN summit that held in Vancouver.
Manfred Paul is the researcher who worked on exploiting the Firefox vulnerability within eight seconds.
Both the vulnerabilities informed to Mozilla foundation and patch has been released as a part of emergency patches.
CVE-2022-1802
A “prototype pollution in Top-Level Await implementation,” could allow an attacker who corrupted an Array object in JavaScript to execute code in a privileged context.
CVE-2022-1529
An “untrusted input used in JavaScript object indexing, leading to prototype pollution,” which could allow an attacker to send “a message to the parent process where the contents were used to double-index into a JavaScript object.” This, in turn, led to the prototype pollution as described in the first exploit example.
The patched and updated version numbers you are looking for are:
- Firefox v100.0.2 for desktop users
- Firefox v100.3.0 for Android users
- Firefox v91.9.1 for Enterprise ‘Extended Support Release’ users
