Defeating Firefox
summary
Reports 23 Firefox bugs and $45,000 in bounties and demonstrates concrete, repeatable failures: missing spec checks let arbitrary request headers slip through (exfiltrated cookies via fetch API header restriction), HTTP redirects confuse origin checks and let a service worker cache another site’s content (service worker cache misattribution) enabling DOM theft, and sharing TLS session tickets breaks certificate validation under opportunistic encryption session-ticket reuse. Uses Nightly builds, Fiddler/proxy captures, commit logs, Bugzilla and reproducible PoC pages; all exploits reliably run on unpatched builds.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 7:37Spec-based testing for vulnerabilities
- 13:23HTTP redirect security risks
- 27:26Network module mismatches
- 36:10Efficient vulnerability discovery
- 41:18Firefox security response evaluation
- 43:53Acknowledgments and summary
related talks
46mBreaking Out HSTS (and HPKP) On Firefox, IE/Edge and (Possibly) Chrome
48mA Weakness In Chrome & A New Hacking Technique
43mAttacking Modern Web Technologies
57mAutomated Detection of Firefox Extension-Reuse Vulnerabilities
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
19mLive Hacking Session Part 1
33mOffensive Javascript Techniques for Red Teamers