Mozilla Releases Emergency Security Updates to Fix Critical Zero-Day Vulnerability Exploited in the Wild

In the digital age, the term “zero-day vulnerability” sends shivers down the spines of cybersecurity experts, developers, and everyday users alike. This week, the digital realm experienced a wave of unease as Mozilla revealed a critical zero-day vulnerability in its flagship Firefox web browser. This vulnerability doesn’t just affect Mozilla’s Firefox but also has repercussions for other products, like Google’s Chrome.

Identified as CVE-2023-5217, this alarming security flaw stems from a heap buffer overflow weakness in the VP8 encoding process of the open-source libvpx video codec library. In simpler terms, this vulnerability could lead to crashes or, in more severe cases, allow malevolent actors to execute arbitrary codes, opening doors for hackers to gain unauthorized access.

Mozilla’s advisory, published this Tuesday, alerted the community, stating, “Specific handling of an attacker-controlled VP8 media stream could lead to a heap buffer overflow in the content process. We are aware of this issue being exploited in other products in the wild.” More concerning is the confirmation that this flaw has already been exploited elsewhere.

Recognizing the urgent threat posed by the zero-day vulnerability, Mozilla swiftly released emergency security updates, including Firefox 118.0.1, Firefox ESR 115.3.1, Firefox Focus for Android 118.1, and  Firefox for Android 118.1.

Given the real-world exploitation of this vulnerability, all users are advised to promptly install the updated versions of Firefox.

Mozilla’s advisory held another revelation: the CVE-2023-5217 zero-day also affects other software, most notably Google’s Chrome web browser. Google, not one to be caught off-guard, patched this flaw by Wednesday, also stating its awareness of an existing exploit for this zero-day vulnerability.

The revelation of this bug came from none other than Google Threat Analysis Group’s (TAG) Clément Lecigne, highlighting the flaw on September 25. The Google TAG, with a reputable track record for identifying zero-days, often finds these vulnerabilities being manipulated in targeted spyware attacks, often by government-backed entities against high-risk targets like journalists and politicians. This specific zero-day was exploited to disseminate spyware, a revelation made by Google TAG’s Maddie Stone.