Mozilla Releases Emergency Patch for Firefox Due to Vulnerability Being Actively Abused

Mozilla has released an emergency patch for its Firefox browser due to a vulnerability that malicious parties are actively exploiting. The company recommends that users update to version 72.0.1 immediately.

Mozilla will notify users of the need to update immediately via a notification in the browser. The leak is in the IonMonkey compiler, the company reports. That is a Javascript jit compiler. The bug is in incorrect alias information which can lead to a ‘type confusion’. This allows an attacker to crash the browser and exploit that crash for an attack. There are no further details yet.

The bug is similar to bug CVE-2019-11707, which Mozilla fixed in version 67.0.3. The patch comes a day after the release of Firefox 72 and is necessary because Mozilla has seen that attackers are actively exploiting the vulnerability. It is unknown where and when that happened. In addition to Mozilla, the US Cyber ​​and Infrastructure Security Agency also recommends implementing the updates as soon as possible, because the government organization has seen that criminals abuse the bug. You can make updates manually via the Help-About Firefox menu or via the download page. The ESR version of Firefox is 68.4.1.