Major browser providers scramble to patch an 18-year-old vulnerability affecting MacOS and Linux systems but Windows remains gloriously immune

We Windows users are sometimes the butt of the joke when it comes to cybersecurity issues. Or at least, we often used to be. Still, if I receive one more lecture on why Linux or Mac systems are more secure, I'll at least have this article to point to. Not always, I shall say. Not always.

Oligo Security's research team has discovered a “0.0.0.0 Day” vulnerability that affects Google Chrome/Chromium, Mozilla Firefox and Apple Safari browsers, enabling websites to communicate with software running on MacOS and Linux systems (via The Hacker News).

The vulnerability means public websites using .com domains are able to communicate with services running on the local network by using the IP address 0.0.0.0 instead of localhost/127.0.0.1.

The good news, if you're a Windows user at least, is that Microsoft's OS blocks 0.0.0.0 at a system level. Hooray for the sometimes-rarer-than-we'd-like Microsoft security win. The bad news for the rest of you is that this loophole is said to have been exploitable since 2006, which means it has been an active cybersecurity vulnerability for an astonishing 18 years.

It's said that the percentage of websites that communicate using 0.0.0.0 is on the rise. Looking at Chromium counters, Oligo has identified 0.015% of websites that could potentially be malicious. That might not sound like a lot, but according to the team, there are an estimated 200 million active websites as of August 2024. 

That's potentially 100,000 websites communicating over that particular IP address, although how many of them are using that capability for nefarious purposes is currently unknown.

Oligo disclosed its findings to security teams from each of the major browsers affected in April 2024, which the company says was acknowledged by each, and that changes are underway to plug the vulnerability.

However, it's up to browser developers to implement their respective fixes, and those fixes have been rolling out to different browsers at different times.  Chrome is already blocking access to 0.0.0.0—starting with Chromium 128—and Google plans to gradually roll out the change with completion set for Chrome 133.

Apple-based browsers like Safari use Webkit, which has already blocked 0.0.0.0. since the report. As for Mozilla Firefox, there is currently no immediate fix, but Mozilla has changed the Fetch specification to block 0.0.0.0 attempts. According to Oligi, "at an undetermined point in the future, 0.0.0.0 will be blocked by Firefox."

Call me slightly smug, but given some high-profile Windows cybersecurity-related failures of late I'll take any win I can get. If you're a Windows PC user, it's finally time to take a victory lap. This one's not on us, folks, and we can rest easy in our beds tonight.