News for hackers. Stuff that matters.

A comment on Mozilla patches two use-after-free vulnerabilities (ab)used in the wild. Parent comment

Re:Mozilla patches two use-after-free vulnerabilities (ab)us... by SubzeroCarnage on Saturday March 05, 2022 @09:23PM (#30574408)
The biggest issue is that Firefox on Android runs all websites in the same process.

https://bugzilla.mozilla.org/show_bug.cgi?id=1565196

Another example, third party Chromium builds like Vanadium or Mulch also go further and enable CFI on Android (still default disabled upstream last I checked).

[ Parent | on HN ]
Re:Mozilla patches two use-after-free vulnerabilities (ab)us... by xorcist on Sunday March 06, 2022 @07:55AM (#30577278)
Chrome also has what, at least from the outside, looks like a little more refined mitigations for WebGL.

That said, both browsers have huge attack surfaces. The best you can do for any of them is to disable WebGL, WebRTC, WebUSB etc. completely and only enable the ones you need. This does much more for your security when browsing the web than the differences between browsers.

The plugins for Firefox to expose this functionality have at least traditionally been a little bit more user friendly.

Opt-in javascript functionality would be the next step.

[ Parent | on HN ]
Re:Mozilla patches two use-after-free vulnerabilities (ab)us... by SubzeroCarnage on Sunday March 06, 2022 @03:35PM (#30581012)
I maintain configs for both to do just that!

https://gitlab.com/divested/brace/-/blob/master/brace/etc/ch...

https://gitlab.com/divested/brace/-/tree/master/brace/usr/li...

[ Parent | on HN ]