Kurniawan is also credited for finding a use-after-free bug (CVE-2021-23997) that can be triggered by the releasing of a web-based font from the browser’s cache. Responsive design is a term used to describe how websites automatically adapt to different sized screens We presume that with enough effort this could have been exploited to run arbitrary code,” wrote Mozilla. “When Responsive Design Mode was enabled, it used references to objects that were previously freed. One is (CVE-2021-23995) is a bug described as a “use-after-free in responsive design mode”. “By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage’s viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user,” Mozilla wrote of the bug tracked as CVE-2021-23996.īug hunter Irvan Kurniawan is credited for unearthing two of the high-severity bugs and one moderate flaw fixed in Firefox Monday.

Other bugs, rated high-severity, are flaws ranging from memory corruption bugs to one that allowed a rogue website to render a malicious JavaScript outside a webpage’s visible content window. It indicates the communication is encrypted using HTTPS and utilizes an SSL/TLS certificate. The browser padlock icon, used by all major browsers, indicates a secure communication channel between the browser and the server hosting the website.

The vulnerability has a severity rating of moderate, Mozilla reported. FREE! Register by clicking above.Ĭredited for discovering the spoofed secure lock icon is independent researcher Jordi Chancel, who on Decemtweeted “I discovered again a new SSL Spoofing Issue (and others vario security issues last 2 months)”. Join experts from Digital Shadows (Austin Merritt), Malwarebytes (Adam Kujawa) and Sift (Kevin Lee) to find out how cybercrime forums really work.

Lock mozilla firefox homepage