librewolf/issues
25
145

nmhproxy is a needless attack surface #3091

Open
opened 2026年06月16日 08:55:15 +02:00 by mimasama · 2 comments

BZ 1881567 has added a black box listening proxy that listens for native messages from Google Chrome and allow remote direct control of the browser from there.

This seems like an easy way for malware to hijack LibreWolf (and other Firefox-based browsers since version 125) if they figure out the control protocol for it.

According to BZ 1886595 it's not enabled by default, but I think LibreWolf should still remove it, especially when it caused a binary signing issue in the past (see #2950).

[BZ 1881567](https://bugzilla.mozilla.org/show_bug.cgi?id=1881567) has added a black box listening proxy that listens for *native messages* from Google Chrome and allow remote direct control of the browser from there. This seems like an easy way for malware to hijack LibreWolf (and other Firefox-based browsers since version 125) if they figure out the control protocol for it. According to [BZ 1886595](https://bugzilla.mozilla.org/show_bug.cgi?id=1886595#c3) it's not enabled by default, but I think LibreWolf should still remove it, especially when it caused a binary signing issue in the past (see #2950).

Why exactly is the disabled state not enough in your case?
#2950 seems to be unrelated here.

Why exactly is the disabled state not enough in your case? #2950 seems to be unrelated here.

There wasn't any "binary signing issue" specific to this file, other than that we had to figure out at what point in the build process all executables and libraries were gathered in one place, so the signing could start.

There wasn't any "binary signing issue" specific to this file, other than that we had to figure out at what point in the build process all executables and libraries were gathered in one place, so the signing could start.
Sign in to join this conversation.
No Branch/Tag specified
main
No results found.
Labels
Clear labels
Branding
Issues that relate to our logo or the branding of our browser and website.
Broken Upstream
Issue is also present in Firefox
Build
Alpine
 Issues specific to the Alpine Linux build of LibreWolf.
Build
AppImage
 Issues specific to the AppImage release of LibreWolf.
Build
AUR
 Issues specific to the AUR build of LibreWolf.
Build
Debian
 Issues specific to our official release for Debian based distros.
Build
DebianOBS
 Issues specific to the non-official OBS build of LibreWolf.
Build
Fedora
 Issues specific to our official release for Fedora.
Build
FedoraCOPR
 Issues specific to the non-official COPR build of LibreWolf.
Build
Flatpak
 Issues specific to the Flatpak release of LibreWolf.
Build
Gentoo
 Issues specific to the Gentoo build of LibreWolf.
Component: Infrastructure
Issues related to infrastructure provided by LibreWolf
Component
Builds
 Issues related to how we build LibreWolf
Component
Patches
 Issue with one of the patches in our source code.
Component
Settings
 Issues related to the settings of LibreWolf.
Component
UI
 A purely cosmetic issue in our browser.
Component
Website
 Issues with our website.
Docs
Change required
 A needed change in our documentation.
Docs
FYI
 Issues that document a change, or how stuff gets patched, built or configured.
Flag
Caution
 Change that might be tricky or that needs to be carefully evaluated. Best suited for core members.
Flag
Good first issue
 Suited for a first contribution as it is a straightfoward task!
FreeBSD
Issues related to the FreeBSD release of LibreWolf.
Linux
Issues realted to one or all our Linux releases.
macOS
Issues realated to the MacOS release of LibreWolf.
Needed
Help
 We are stuck :-(
Needed
Info
 Closing in ten days if no details are provided.
Needed
Testing
 We are almost there!
Prio
High
 Issues with a high priority
Prio
Low
Prio
Normal
Prio/Urgent
Issues needing immediate attention
Repositories
An issue with our repositories.
Research
Collecting informations to document something or to evaluate a change.
Source
Issues related to the source code of LibreWolf.
Status
Blocked
 An issue blocked by another one.
Status
Duplicate
 Look for existing issues.
Status
Icebox
 Change that is not happening soon or issue that cannot be tested.
Status
Known issue
 An issue that we are aware of but that we cannot fix at the moment.
Status
Not Planned
 The requested feature is currently not planned
Status
Upstream
 Either we upstreamed the issue or a fix is coming directly from Mozilla!
Status
Won't fix
 Does not require a fix.
Type
?
 What?
Type
Bug
 Ouch...
Type
Discussion
 Let's have a talk...
Type
Feature
 A feature request.
Type
Question
 Not a issue but just a user question
Type
Task
 This needs to be done
Windows
Issues related to the Windows release of Librewolf.
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
librewolf/issues#3091
Reference in a new issue
librewolf/issues
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?