Privilege Escalation in Firefox DOM Content Processes

Executive Summary

This is a privilege escalation vulnerability in Firefox's DOM Content Processes. It allows a compromised content process to inject persistent TLS certificate overrides for any hostname by sending an AddCertException IPC message to the parent process without proper authorization checks. The override is stored in cert_override.txt and persists across browser restarts, enabling future man-in-the-middle attacks.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected entries in the cert_override.txt file in your Firefox profile directory. This file may contain unauthorized TLS certificate overrides if the vulnerability is exploited. Use commands like 'find ~ -name cert_override.txt' on Linux or 'dir /s cert_override.txt' on Windows to locate the file.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to intercept and decrypt your communications with non-HSTS-preloaded websites. They could silently install malicious certificates that your browser would trust indefinitely, allowing ongoing surveillance or data theft without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Firefox versions may face compliance failures due to insufficient protection of personal health or user data during transmission.

Useful 0 Not Useful 0

Mitigation Strategies

Update Firefox to version 153 or later immediately. If you cannot update, disable the affected component by setting security.tls.insecure_fallback_hosts_use_strict to true in about:config, but updating is strongly recommended.

Useful 0 Not Useful 0