Malicious sites can crash Firefox via pop-up vulnerability

Firefox has a vulnerability that allows rogue websites to bombard users with a relentless stream of authentication pop-ups. Sites take advantage of this by tricking users into calling a help desk behind which scammers are hiding.

The vulnerability was originally reported to Mozilla three months ago and Mozilla could not immediately tell Ars Technica when a fix for the problem is expected. Ars also has a link to a site that exploits the vulnerability. According to the researcher who brought the vulnerability to the attention of Ars, Firefox has another vulnerability that has not been fixed two years after the first report. However, it does not appear to be actively exploited at the moment.

In addition to authentication pop-ups, users are also bombarded with download dialogs and text-to-speech output stating that the computer has been hacked. Users are urged to call the ‘helpdesk’. Whoever calls the number will most likely be asked to provide bank details. This method seems to have little chance of success with tech-savvy users; It is not known on what scale the vulnerability is being exploited.