Author: Martin Brinkmann

Security researchers have disclosed a vulnerability that affects all modern browsers. What makes it particularly worrisome is that it has been known for 18 years; that goes back to a time before Google even thought of creating Chrome.

The details:

• The researchers call the issue 0.0.0.0 Day.
• It allows malicious websites to interact with services that run on the local network.
• This could lead to unauthorized access or remote code execution attacks on local services from outside the local network.

In other words: the security issue allows the circumvention of security protections by malicious websites. Chromium’s Private Network protection does not protect against this, neither does Firefox. Apple’s Safari browser was also vulnerable, but the company has released a patch that blocks access to 0.0.0.0.

The blog post provides a technical description of the vulnerability. It also explains why it took this long to react on it.

The researchers found a Mozilla bug listing that dates back 18 years. It shows that the developers were not sure whether the reported bug was a security issue, a bug, or no flaw at all.

How Google, Mozilla, and Apple plan to react

Researchers at Oligo disclosed the vulnerability to security teams of major browsers in April 2024.

• Google: plans to block access starting in Chrome 128 and finalize the rollout by Chrome 133. Other Chromium-based browsers will get this as well.
• Apple: has implemented a change that blocks destination host IP addresses, if the IP is all zeroes.
• Mozilla: fix is in progress. Firefox is special, as it never restricted Private Network Access in first place. Will implement Private Network Access, but no ETA on this one.

The fixes are important, but so is standardization of the issue. HTTP requests to 0.0.0.0 should be added to security standards according to the security researchers.

Closing Words

The security researchers note that use of 0.0.0.0 on the Web is on the rise. They use counters provided by Chromium for this. According to those, it is used by 0.015% of all websites. While that may not sound like much, it equates to roughly 100,000 public websites that may communicate with 0.0.0.0.

Malicious actors may exploit the issue in their attacks. Oligo points out that ShadowRay, a recent attack that targets AI workloads, could be executed from browsers using 0.0.0.0 as the attack vector.

It is unclear if browser extensions such as Port Authority for Firefox provide protection against this kind of attack.

What is your take on this new vulnerability? Seems that there is always something new, or shall I say old, that is affecting the security of browsers. (via Born)

Google Chrome users who have extensions installed may soon have some or even all of their installed extensions disabled by Google.

While all browser extensions may be impacted, it is ad blockers and privacy extensions that are impacted the most.

One example: uBlock Origin, arguably the most loved and powerful content blocker available for browsers, will not be offered anymore for Chrome and all other Chromium-based browsers.

This means that you cannot install the browser extension anymore in Chrome, Microsoft Edge, Vivaldi, Opera, and myriads others.

One exemption: Brave Software revealed recently that it plans to continue support for uBlock Origin. This would be the one exemption at the time of writing.

The developer of uBlock Origin has created a lite-version of the extension. Called uBlock Origin Lite, it remains available for Chrome. Its functionality is reduced, however.

Furthermore, users of Chrome who use uBlock Origin need to download and install uBlock Origin Lite manually. A click on the “find alternative” button in Chrome

How to find out if you are impacted by the change

Do the following to find out if extensions that you have installed in Chrome are impacted:

• Load chrome://extensions/ in the browser’s address bar. You may also open the page manually by going to Menu > Extensions > Manage Extensions.
• If you see “These extensions may soon no longer be supported” at the top, you are affected by the change.

Tip: you can check out a detailed guide about this here.

Google lists all incompatible extensions. Each features a “find alternative” button, which opens a special page on the Chrome Web Store that highlights extensions that continue to remain compatible with Chrome in the future.

For uBlock Origin, Google suggests the following options:

• uBlock Origin Lite
• Adblock Plus
• Stands Adblocker
• Ghostery Tracker & Adblocker

While all block ads, none offers the functionality of uBlock Origin.

What you can do about it

You have just a few options at this point:

1. Keep on using Chrome until Google disables the extensions. You may then extend support for about a year using Enterprise policies.
2. Keep on using Chrome and use a different browser extension that works for you, hoping that Google does not introduce any other changes in the future that may impact it.
3. Switch to Brave Browser. This is a valid option only if you want to keep on using uBlock Origin, AdGuard, uMatrix, or NoScript.
4. Switch to Firefox or a Firefox-based browser. The extensions, including uBlock Origin, remain available and maintained for Firefox.

The first option is valid for all Chromium-based browsers, but it is temporary only. Google will remove the Enterprise policy next year, and that marks the end of support in Chrome.

As you see, you have a few options only. While you could keep on using a Chromium-based browser, Brave Browser, it is unclear for how long Brave will support the four special extensions.

Admittedly, it is also unclear for how long Mozilla will support the old extensions system. If it sees an uptick in users, as some Chrome users may migrate to Firefox because of the changes Google implements, it could very well be for a long time.

Are you affected by the change? Do you have any extensions that you rely on that would make you switch browsers, if your current favorite would not support them anymore? Feel free to leave a comment down below.