Mozilla patches two use-after-free vulnerabilities (ab)used in the wild | Hacker News Reader

Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

mozilla.org

112 pointscaaqil64 comments

My Mull builds for Android had this update out <6 hours after. https://divestos.org/misc/ffa-dates.txt

Fennec F-Droid should be updated by Wednesday or so. https://gitlab.com/fdroid/fdroiddata/-/merge_requests/10706

I use Firefox on Ubuntu and Android. I love Firefox more than Chromium-based browsers. But security is the one thing that makes me think of switching.

Two minor things that prevent me from switching to Chromium-based browsers:

1. There is no addon functionality on Android for Chromium-based browsers. For example, I can add the uBlock addon on Firefox for Android but not Chrome for Android.

2. There is no option to place the address bar at the bottom of the screen for one-handed usage, as in Firefox Android.

I have found brave to be a decent chromium-based browser for android if the only addon needed is for ad blocking. It has a bottom toolbar provides a similar experience to the firefox bottom address bar.

I 2nd this

I agree with you entirely. My third reason to stick with Firefox is to vote with my feet regarding browser engine diversity.

This keeps getting repeated and I still haven't heard a convincing argument on why that's a good thing. Chromium/Blink is opensource, has two megacorp contributors (Microsoft and Google) - it's a far cry from MS IE monopoly. Plus Apple has WebKit.

Firefox just adds incompatibility to the mix of things you have to support, frankly I'd switch to Firefox if they decided to build it on top of Chromium.

When they were actively working on Servo and had devtools team I could see the potential, but after they sacked those - what's the point ? Market share is shrinking so compatibility is going to get worse, devtools are worse, performance/stability is worse in my experience.

When Google wants a feature implemented in Chromium, it gets implemented, pretty much regardless of how buggy it is. When I want a feature implemented and Google wants it not implemented… tough luck.

Is that different with Firefox? I haven't been paying attention in a while now but I constantly read complaints about UI changes - and Firefox has it's share of experimental features that ended up being exploited or abuse (asm.js comes to mind).

It's not much different with Firefox, no. I was making a point that browser monopolies are bad; the fact we only have three real browser engines (two of which are based on Konqueror) is a problem.

But at least Mozilla do a basic back-of-the-envelope “is this feature a huge security vulnerability” check before shipping. (Looking at you, <portal>.)

Only in the sense that when Google wants a new web standard the Firefox devs need to be convinced before it happens there. That has stopped a few, but not all, user hostile things from becoming defacto standards over the years.

When Google invents a feature I want, Mozilla writes a position statement on how it's evil and never implements it.

It's hard to get behind engine diversity when Mozilla is trying to take the web in a direction I don't really want.

Meanwhile Brave does the same thing, but with Cryptocurrency.

I wish we had an open source clone of Vivaldi.

What features are you referring to?

FLoC may be one that could be characterized as “evil.” I mainly think about APIs that extend beyond the browser, like USB or Bluetooth, that Firefox won’t do for security reasons.

Those are the features I was thinking of.

FLoC seems to be pretty irrelevant to anyone not directly working on ad infrastructure, so I'm fine with Mozilla ditching that.

Just look at the most recent changes to webextensions that chrome is trying to do... basically solely to make ad blocking nigh impossible. That's why browser diversity matters.

How much does Microsoft actually contribute to Blink's core really? The benefit for Microsoft of Chromium Edge is they get to outsource development. Their interest is in making it run well, and so far they've largely left the web features to Google. If Firefox became a Chromium fork they'd be just another junior partner in name only; Google would still be running the show on policy. In fact, possibly worse, because of their poor negotiating position.

WebKit only matters because of iOS, and Blink and WebKit still share a lot of DNA. It's not a credible competitor otherwise.

I do agree killing Servo was a shortsighted move, but, speaking as a long-time Mozilla community member, that's hardly the only shortsighted move MoCo has ever made (see also: dumping embedding for Fx4).

>The benefit for Microsoft of Chromium Edge is they get to outsource development

They also wanted to get superior compatibility. While the old edge was quite a bit better than IE, it still feel short.

I don't think it's enough that Chromium is open source. Yes it's very different from the MS IE monopoly, but Google has a very different business model compared Microsoft.

The value of IE to Microsoft was to lock people into Windows - both developers and users. They recognized that the web would become a software platform in its own right, and knew that if everyone ended up using web software then it'd be a lot easier to use non-Windows platforms.

Google gets much of its revenue from web advertising, so the value of Chromium to Google is to keep the web profitable for them. For example, Mozilla can't do to Google what Apple did to Facebook. They can do things like veto any move away from cookies as the primary tracking mechanism, at least until they have an alternative ready to go.

An open source license doesn't fully solve the problem because forking Chromium isn't enough. All the software on the web is built on top of APIs that Google gets a say in, and these are designed to be useful for ad/tracking networks.

The point is Firefox has preferable ergonomics. For example, Firefox allows an end-user to specify their own fonts and colours. Chrome/Edge do not allow this.

Do you really think Chrome is safer than Firefox?

Anecdotally, yes. Would be great to get information on the contrary.

Depends on your threat model.

Why would this make you think Firefox is less secure? They've publicly disclosed they've fixed an issue. That's what you want.

I didn't say that this specific link made me think Firefox is less secure. Advisories are great and everyone should do them.

But as someone in the security community (not browsers), I've heard Chrome is a much harder target.

Would love for someone actually aware of the browser security scene to let me know if otherwise.

They have a larger and better funded security team, but Chrome is also a large target and gets exploited all the time as a result.

I'm not sure there's that much difference in browser security. There were tiny nits where Chrome was somewhat stricter that I was aware of (e.g. handling of nosniff header), but most of that has been fixed at some point. Mozilla was somewhat slower with some security improvements like site isolation, but eventually catched up.

Memory safety is a general problem, but all browsers have it. "We urgently fixed this use after free bug because we've seen exploits in the wild" is something you can read about Chrome every now and then as well. It's not good, but noone has a solution for that right now. With Rust Mozilla is at least working on getting a handle on that.

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead.

https://grapheneos.org/usage#web-browsing

It's basically universally agreed among security people that Firefox is less secure than Chrome. It's up to you to decide is it's likely Mozilla's caught up in the (year?) since this was written,. Or if they'll ever be able to catch up, with their current funding, compensation packages, the size of their workforce (750 employees?), their hiring attractiveness to top security researchers, and their management priorities.

That seems to be quite focused on the situation with Firefox on the Android/Graphene environment.

>It's basically universally agreed among security people that Firefox is less secure than Chrome.

A reference would be nice here...

The biggest issue is that Firefox on Android runs all websites in the same process.

https://bugzilla.mozilla.org/show_bug.cgi?id=1565196

Another example, third party Chromium builds like Vanadium or Mulch also go further and enable CFI on Android (still default disabled upstream last I checked).

Chrome also has what, at least from the outside, looks like a little more refined mitigations for WebGL.

That said, both browsers have huge attack surfaces. The best you can do for any of them is to disable WebGL, WebRTC, WebUSB etc. completely and only enable the ones you need. This does much more for your security when browsing the web than the differences between browsers.

The plugins for Firefox to expose this functionality have at least traditionally been a little bit more user friendly.

Opt-in javascript functionality would be the next step.

I maintain configs for both to do just that!

https://gitlab.com/divested/brace/-/blob/master/brace/etc/ch...

https://gitlab.com/divested/brace/-/tree/master/brace/usr/li...

Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865

Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."

I have been dragging my feet on leaving Firefox for security reasons for so long, and just now I have come to terms with how ridiculous that is.

I’ve known about the security team, and I remember hearing that even prior to that, a CTF event had banned Firefox exploits as too easy.

I am doing it next time I open my work laptop. I mean what is the single most important class of features in a browser? Security. I feel dumb for waiting so long.

This makes me sad. I was emotionally invested invested in Mozilla and that caused an error in judgment.

Turns out I was thinking of pwn2own in 2016 [0]. Can anyone update me on how Firefox does these days at CTFs?

[0] https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...

I would also like to point out that I would absolutely pay $5/month via something like a Patreon which funded an organized group of security minded devs to work on Firefox security issues.

It's not a money issue. It's money allocation problem. Mozilla has plenty of money they just don't care about security that much. They care more about Pocket and other useless junk that probably nobody, but they care about.

I use Firefox, but only because of "browser diversification" and privacy. Other options are worse not because Firefox is a superior product. It's sad really.

Yeah, I have to say that this is the only tech product that I am very emotional about at this point in my life. I want Firefox to win so bad, even now, as I’m leaving it.

But I feel like I would be doing a disservice to myself, and my employers, by continuing to use a less secure browser, just because I’m religious about Mozilla.

The thing i’m still trying to understand is why Mozilla management is so hell bent on crippling their flagship product? RIP Servo, among other forward looking technologies.

Follow the money?

But according to your own link, it was confirmed that they didn't do that? Did you mean to link to something else?

They fired part of their security team, namely the entire security response and threat management teams, according to that link and the linked tweets. They still have some security team left.

There are more factors affecting your safety as a user: how popular a target is the app? Eg a Linux desktop is thought to be less likely to get a malware infection than a Windows desktop, even though Windows has more security investment and attention and mechanisms (antivirus, quarantined files, etc) to defend against this. The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware.

We're reduced to reasoning like this because we've in browser security apathy.

If only there was a browser that wasn't implemented by juggling chainsaws like this... It's ridiculous that we have been unable to just fire all the these apps for sane reimplementation. Feeding hostile internet content to millions of lines of unsafe code day in, day out on billions of user devices would sound like a ridiculous idea if it were invented today.

> It's ridiculous that we have been unable to just fire all the these apps for sane reimplementation

It is unfortunately nigh impossible to reimplement the web with its gigantic scope.

It's easy to get daunted at least.

A realistic scenario could be something along the lines of: get content onboard by securing some buy-in from some heavyweights, for a reduced feature set. Maybe convince a incumbent browser vendor or two to also provide a safer kernel for that content profile. Then targeting that feature set with the new implementation, and supporting a compatibility mode fallback to a legacy rendering engine for other web content. (VM-based or remote cloud based sandboxed rendering for the fallback?)

But the above would of course have a much better chance of taking off if there was a promising start of an implementation first, so it's not necessarily a reason to wait for the big boys before working on it.

(I wonder if Servo could be a starting point?)

> The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware.

Firefox is Tor Browser which is the most attractive target by far for 0 days. 0 days are often not targeted to a single individual anymore but are commonly used "in the wild" against mass targets, e.g. everyone who browses a political dissident website.

This sounds like a plausible factor but on the other hand, people who use Tor might be more security conscious and/or tech savvy, frequently run in a sandbox VM - and those unpatched vulnerabilities might get burned sooner if used on them. Any evidence or data would be interesting to see of course.

To me, not having an integrated translator in android Firefox is a deal-breaker

Oh yeah, this was a huge annoyance when I was in another country.

Mozilla laid off the bulk of their security team, there will be a natural decline in security over time.

Kiwi Browser (https://kiwibrowser.com/) is a FOSS Chromium for Android derivative that supports Chrome extensions.

Kiwi Browser is not FOSS. They have a skeleton GitHub repo with Chromium code. Their patches aren’t published.

Their patches do seem to be available under BSD here: https://github.com/kiwibrowser/src.next/blob/kiwi/LICENSE

Install Samsung Internet Browser. It's Chromium and it will run on non-Samsung devices. You can install the AdGuard add-on in it. It will let you put the bar at the bottom too.

That said, I use Firefox on my desktop.

Thanks, I've just started using it and it fits all my needs.

Is there extension support in other Chromium based mobile browsers? If not, why not?

Security is what you worry about as a top concern? Have you ever been personally hacked by a malicious website?

I've been running Firefox since version 3, every day, searching for all kinds of stuff online daily (I work as a devops and programmer guy). Never had anything happen whatsoever.

Firefox has alerted me that my email has been part of hacks of random sites however, but since I use a password manager with different passwords for each site, I don't even worry about that. Chrome doesn't even inform you about those hacks as far as I know.

What happened to rewriting the browser engine in Rust? Isn't the language supposed to prevent this sort of bugs?

I would like to know the same thing.

And I would also like to know why you're being downvoted.

Maybe somebody will reply instead of downvoting. That would be nice.

The decision to kill off Servo is looking less and less smart.

They ditched it. Probably was too useful, so decided allocate their resources to more useless projects. Go look at the Mozilla blog. They don't give a fuck about their browser.

I use Firefox, but the project is a sad train wreck.

And while we’re on the topic, even within C++, why isn’t Mozilla using better dev practices that avoid use-after-free bugs?

Is there a way to disable XSLT in Firefox?

I’m curious why the second bug is labeled critical. WebGPU is still disabled isn’t it?

Proactive security: patching vulnerabilities after they are (ab)used in the wild.

So open the bugs are not viewable.

Reply on news.ycombinator.com