Mozilla fixed this vulnerability in Firefox 100.0.2 via Mozilla Foundation Security Advisory 2022-19. You can find more information about this vulnerability on the Zero Day Initiative advisory page tracked as ZDI-22-799. This vulnerability, known as CVE-2022-1802, is a prototype pollution vulnerability in the await implementation. In this blog, we will look at the first vulnerability in the chain, which was used to compromise the Mozilla Firefox renderer process. Although his exploit used some memory corruptions, the vulnerable code was written in a memory-safe programming language: JavaScript! In fact, both vulnerabilities used in the chain were related to one rather notorious language aspect of JavaScript – prototypes. At Pwn2Own Vancouver 2022, Manfred Paul compromised the Mozilla Firefox browser using a full chain exploit that broke the mold. One way to eliminate such memory safety issues is to use a memory-safe language such as Rust or even JavaScript itself.

Typically this involves either a direct error in memory management or a way to corrupt internal object state in the JavaScript engine. Vulnerabilities and exploits in common targets like browsers are often associated with memory safety issues.

Mozilla firefox written in