Last week, the Tor anonymity network released an urgent patch to address a critical security flaw, CVE-2024-9680, that had been actively exploited against its users. This vulnerability, first discovered by a researcher from the cybersecurity firm ESET, allows attackers to execute malicious code within the browser’s content process, the area responsible for loading and rendering web content.
The vulnerability, initially patched by Mozilla in its Firefox web browser, has also affected the Tor Browser, which is built on the Firefox platform. According to a statement from Tor, Mozilla confirmed that this flaw was being exploited in real-world attacks targeting Tor Browser users. The flaw does not appear to compromise anonymity within Tails, a secure, privacy-focused operating system that routes all traffic through the Tor network. Tails also ensures that no data is left behind on the host system after shutdown, offering tools like encrypted email, secure messaging, and disk encryption to bolster privacy.
The CVE-2024-9680 bug is classified as a “use-after-free” vulnerability, a type of memory corruption error that occurs when a program attempts to access memory that has already been freed. Such bugs are commonly exploited to target browsers, often granting attackers control over the affected service and potentially providing further access to the system. With a CVSS score of 9.8 out of 10, this flaw is considered critically severe due to its low complexity and ability to be executed over the network without requiring user interaction.
Both Mozilla and Tor have strongly advised users to update their browsers immediately to mitigate the risk of falling victim to this exploit. Keeping browsers up to date is essential in maintaining security, especially when vulnerabilities like this are being actively targeted.
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
