Firefox update addresses security flaws

Mozilla has released an update for Firefox, fixing a large number of security vulnerabilities. Some of these flaws could allow malicious code to escape the browser's isolated processes, potentially increasing the risk of attacks.

Vulnerabilities include high-risk issues

The update addresses 167 vulnerabilities, with 108 classified as high risk. These flaws affect various parts of the browser, including its JavaScript engine, graphics rendering, and memory management. Some of these issues could allow attackers to bypass protections meant to prevent compromised web pages from accessing the system.

Sandbox bypass vulnerabilities identified

Thirteen of the fixed vulnerabilities could allow malicious code to bypass the browser's sandbox. Firefox uses a sandbox to isolate web content in processes with limited permissions, reducing the damage from potential attacks. These flaws could have allowed compromised websites to access more system resources than intended.

Memory-related issues dominate the update

A significant number of the vulnerabilities are related to memory management, specifically 97 use-after-free errors. These occur when a program reuses memory that has already been freed, potentially leading to crashes or allowing malicious code execution. Other issues include privilege escalation and bypasses of the same-origin policy, which normally prevents websites from accessing data from other sites.

Mozilla updates its security reporting process

Mozilla has changed how it reports security flaws, now assigning individual CVE identifiers to each memory-related vulnerability found internally. This change explains the higher number of reported vulnerabilities. Firefox updates are usually automatic, but users can check for updates manually through the settings menu.

Extended support versions also receive patches

Firefox ESR 153.6.0 includes fixes for 145 vulnerabilities, while ESR 115.44.0 addresses 80. Both versions continue to receive updates, with ESR 115.44.0 supported on older Windows and macOS versions until March 2027. Android users receive updates through the Google Play Store.