NITDA Warns of Security Errors in Mozilla Browser Creating Malware Codes to Steal Files & Crash System

Two critical security vulnerabilities, CVE-2022-26485 and CVE-2022-26486 which affect the Mozilla Firefox web browser have been actively exploited in the wild.
Raising the alarm in his security report put together by the team at CERRT.NG, the National Information Technology Development Agency (NITDA) warned that the bug opens access to classified files.


The vulnerabilities are classified as use-after-free bugs, which is a memory corruption bug that causes the inevitable crash of system programs if exploited.

According to the report, with these vulnerabilities, attackers could trick users into running their malware code which leads to a booby-trapped website, gain access to files that are meant to be inaccessible, crash system programs and carry out remote code execution.

The report added that the flaw can also cause valid data be corrupted.

Technical details of the bug reveals that the zero-day flaws tracked as CE-2022-26485 and CVE-2022-26486, was described as use-after-free issues impacting the Extensible Stylesheet Language Transformations (XSLT) parameter processing and the WebGPU Inter-Process Communication (IPC) Framework.

It warned that removing an XSLT parameter during processing could lead to an exploitable use-after-free adding that an unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape.

The report explained that XSLT is an Extensible Markup Language (XML)-based language used for the conversion of XML documents into web pages or PDF documents, whereas WebGPU is an emerging web standard that’s been billed as a successor to the current WebGL JavaScript graphics library.

On prevention measures, the NITDA report urged users to install all updates released by Mozila: Firefox 97.0.2, Firefox ESR 91.6.1 and Firefox for Android 97.3.0, as well as Thunderbird 91.62 and Focus 97.3.0 or visit official websites to download latest versions, on Windows, MacOS and Linux or use the App store!/Play store for 1OS and Android users respectively.

Be the first to comment

Leave a Reply

Your email address will not be published.