Firefox PDF Bug Zero Day causes Data Leak and Password Stealing

Mozilla Firefox , the most widely used web browser and know to every common , has been found with a critical bug that allows data leak and password stealing .

Hackingloops recommends you to update your Firefox browser without any delay and make sure you have firefox version 39.0.3 . 

Data theft is just what Mozilla warned about in a blog post published on 06 August 2015, when it announced a critical update for Firefox.

This bug has been known to lead to information disclosures which means that it leads to security holes that allow confidential information leakage and password stealing and even Identity theft .

However this bug is not known to cause Remote Code Execution that allows the attacker to implant a malware on your computer without getting noticed and any popups .

Firefox PDF Bug

The security hole is found in Mozilla Firefox  own built-in PDF viewer. The PDF Viewer is not implemented as a plugin or extention but is actually a client side javascript which allows the user to view the PDF within the Browser without the need of any external plugin.  This is known to be as PDF.js

The PDF viewer is implemented inside the Firefox browser as a JavaScript Program and not as a plugin and allows to view the PDF inside the browser without the need of any external plugin .

However the bug is not known to allow any RCE (Remote Code Execution)that will enable the attacker to run malicious code in the browser , and hence cannot be used to insert any Malware .

However this Javascript PDF viewer can be exploited in several ways .

How Hackers are Targetting the Firefox PDF Bug 

Firefox pdf bug can allow the FireFox Browser to load the malicious javascript from external sources and run it as if the user loaded it locally . So the attacker can use this bug to load a javascript in your browser that can be used to upload files from your computer to a remote server without any prompt or interaction from the user .

So even if the malware is not downloaded on your machine , the attacker is still able to upload files files from your machine and steal critical data from your computer .

The firefox pdf bug is also a Voilation of  Same Origin Policy

Same origin poclicy is simply states that the browser is supposed to disallow javascript from site A from accessing any data from Site B or any other site for that matter . And Clearly if the Javascript program is not allowed to access the data from any other domain ,  It surely should not be allowed to access any data from your computer .

But due to firefox pdf bug , the files from your computer are sneaked away clearly voilating the cross origin policy . According to Mozilla , Hackers have already started exploiting this bug .

So now the adverstisement you see on your favourate news site could be stealing files from your system .