Mozilla Ships Firefox 138.0.4 Within 12 Hours of Pwn2Own Zero-Day Disclosure

Summary

At Pwn2Own, Manfred Paul disclosed a Firefox JIT bounds-check bug that enabled out-of-bounds access. Mozilla prepared a patch disabling the affected optimization, investigated possible fuzzing gaps and released Firefox 138.0.4 in under 12 hours.

Key points

• Manfred Paul demonstrated a Firefox JIT bug in the linear-sums optimization: large-array index arithmetic could underflow while an incorrect bounds check passed, causing out-of-bounds access.
• Mozilla said the bug had been present for about four years. Researchers and engineers discussed why fuzzing had not found it.
• The proposed emergency patch added an early return that disabled the affected optimization; Mozilla planned to measure any performance impact.
• The team considered whether Fuzzilli’s default runtime limit and slower debug-optimized builds contributed to the bug escaping detection; this was still under investigation.
• The Pwn2Own entries discussed were renderer-only exploits. Mozilla explained that a renderer exploit alone does not provide full system access, and the competition disabled Firefox’s content sandbox for those entries.
• Mozilla reviewed, tested and released Firefox 138.0.4 as a security-driven rapid release in less than 12 hours after receiving Manfred Paul’s disclosure.

People