Chromium Browser Bug Impacts Chrome and EdgeĪlso on Thursday, CISA urged Windows, macOS and Linux users of Google’s Chrome browser to patch an out-of-bounds write bug (CVE-2020-15995) impacting the current. Mozilla did not credit the bug discovery, nor did it state whether it was a vulnerability actively being exploited in the wild. If after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error to hack the program,” according to a description of the vulnerability. A use-after-free vulnerability relates to incorrect use of dynamic memory during program operation. A COOKIE ECHO chunk is a snippet of data sent during the initialization of the SCTP connection with the browser.Īccording to Mozilla an adversary could craft a malicious COOKIE-ECHO chunk to impact the browser’s memory. The bug is tied to the way cookie data is handled by SCTP.Įach inbound SCTP packet contains a cookie chunk that facilitates a corresponding reply from the browser’s cookie. The acronym SCTP stands for Stream Control Transmission Protocol, used in computer networking to communicate protocol data within the Transport Layer of the internet protocol suite, or TCP/IP. We presume that with enough effort it could have been exploited to run arbitrary code,” according to a Mozilla security bulletin posted Thursday. “A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a use-after-free. Impacted are Firefox browser versions released prior to the recently released Firefox desktop 84.0.2, Firefox Android 84.1.3 edition and also Mozilla’s corporate ESR 78.6.1 version of Firefox. The vulnerability is classified as a use-after-free bug and tied to the way Firefox handles browser cookies and if exploited allows hackers to gain access to the computer, phone or tablet running the browser software.

On Thursday, the Cybersecurity and Infrastructure Security Agency (CISA) urged users of Mozilla Foundation’s Firefox browser to patch a bug, tracked as CVE-2020-16044, and rated as critical. The Mozilla Firefox vulnerability ( CVE-2020-16044) is separate from a bug reported in Google’s browser engine Chromium, which is used in the Google Chrome browser and Microsoft’s latest version of its Edge browser.

Makers of the Chrome, Firefox and Edge browsers are urging users to patch critical vulnerabilities that if exploited allow hackers to hijack systems running the software.

Mozilla firefox homepage hijacked