It's time to patch, Firefox users. Hackers are exploiting a serious bug in the browser to take over computers.
The vulnerability deals with a Javascript compiler in the browser, which can be used to run malware or crash a computer. "We are aware of targeted attacks in the wild abusing this flaw," Firefox developer Mozilla warned in an advisory on Wednesday.
Specifically, the bug can trigger a "type confusion" flaw, which is when a software program blindly runs a piece of incompatible code. In Firefox's case, the affected compiler is designed to take Javascript code on a web page and convert it to an executable program, which can run directly inside the browser.
"This typically improves performance, often noticeably," security firm Sophos wrote in a blog post. But the same process can pose a security risk. If you can trick the compiler into running bad code, then you can also dupe the browser into running malware. "That's why crooks love to probe for flaws in JIT (Javascript Just-in-Time) systems," Sophos added.
It remains unclear how the hackers were exploiting the bug, but they likely created a malicious website to trigger the flaw, and then tricked unsuspecting users into visiting it.
Researchers at Chinese antivirus company Qihoo 360 uncovered the vulnerability, which has been rated as "critical." The threat is bad enough that the Department of Homeland Security's cyber division also issued an alert urging users to patch.
To stay safe, Firefox users should update to version 72.0.1; enterprise users on Firefox ESR should be on version 68.4.1. Update by going to the "About Firefox" option in the browser, which is under the "Help" tab for Windows users and the "Firefox" tab for Mac users. It's also possible the browser may have already initiated an automatic update.