Mozilla has released patches for the bug reported by Coinbase.

Dark Reading Staff, Dark Reading

June 20, 2019

1 Min Read

Mozilla has patched a critical vulnerability under active exploit in the Firefox browser. 

Digital currency exchange Coinbase reported the vulnerability to Mozilla after discovering it in use for targeted attacks. According to the Mozilla advisory, the type confusion vulnerability (CVE-2019-11707) "can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash." 

The researcher who discovered the flaw – Samuel Groß of Google Project Zero and Coinbase Security – stated on Twitter: "The bug can be exploited for RCE but would then need a separate sandbox escape. However, most likely it can also be exploited for UXSS which might be enough depending on the attacker's goals."

The vulnerability has been fixed in Firefox 67.0.3 and Firefox ESR 60.7.1. Read more here and here.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights