Firefox Zero-Day RCE Caused by Single-Character Typo in SpiderMonkey Engine

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Single-Character Typo Causes 0-Day RCE Vulnerability in Firefox A critical Remote Code Execution (RCE) vulnerability in Mozilla Firefox was identified due to a single-character typo in the SpiderMonkey JavaScript engine’s WebAssembly garbage collection code. The error occurred when a developer mistakenly typed '&' instead of '|', leading to the flaw's discovery by security researcher Erge while reviewing the Firefox 149 Nightly source code. 4 sources 64