Mozilla released Firefox 35to address nine security flaws, three of which are considered critical by developers, that presented the risk to the computer if someone exploited them.
The release of the new version of the web browser was officially announced on Tuesday. Among the improvements, there is an implementation of HTTP Public Key Pinning Extension, which enhances the verification of the authenticity of encrypted connections.
Regarding security updates, the developers set up a Gecko Media Plugin (GMP) sandbox in the Windows system. GMP sandboxing is used for H.264 media files. The bug could be exploited in combination with other vulnerabilities to bypass system security and jeopardize the GMP process. However, Linux and OS X systems are not affected.
Another critical issue addressed in this version is a vulnerability issue of the WebRTC component, which provides real-time communication (RTC) capabilities via APIs.
It was discovered by security researcher Mitchell Harper, and this flaw exists due to the way tracks are handled and results in a system crash or WebRTC not functioning correctly.
Also in Firefox 35, a set of eight bugs that could lead to memory corruption under certain conditions has been fixed. It is believed that if an attacker found a way to exploit these vulnerabilities, they would be able to execute arbitrary code in the browser.
The only high‑risk issue highlighted in Firefox 35 was reported by Google security researcher Michal Zalewski and concerns memory usage during bitmap rendering.
