![]() ![]() In uMatrix three filter lists are enabled – Don Pollock, MVPS and Peter Lowe, others were disabled as they don’t get updated or maybe uMatrix is at fault. All the filter lists bar annoyances and languages are enabled in uBO which includes some already present in uMatrix, and no custom lists. Very few extensions I use in this profile are – uBlock Origin, Clear URLs, Temporary Containers(once in maybe a year as FPI is already enabled) and uMatrix in hard mode. My normal setup for browsing is this – In desktop user.js file(Arkenfox) is applied in one profile which I use most. I hope that this is helpful to anyone out there!įirst thanks to for finding this vulnerability and interacting with regular casual users like me. (3) (that’s the full version in contrast to the light one which is included in uBO.) I have not experienced this breakage in the new 1.4.2 and 1.4.3b0 because I already deactivated these dead lists in my setup months ago.Īpart from the three activated default lists “Dan Pollock”, “MVPS Hosts” and “Peter Lowe” I would like to share the additional (regularly updates) ones, which I use in uM: “hpHosts”, “Malware Domain” list and “Malware domains”. The solution is given in link 2 as well: Disable the dead filter lists in the “assets” tab, i.e. There are some reports about breakage after installing the latest update of uM, see here: Now You: are you still using uMatrix? (thank you Marcus ) While it seems unlikely that it is going to be exploited in large scale attacks, it is still something that users need to be aware of. With development having ended some time ago, it may be time to move to a different extension for content blocking, especially since it has an unpatched vulnerability now. ![]() They can also enable all of the "Malware domains" and "Multipurpose" filter lists in uBlock Origin to help offset the lost filtering coverage. To mitigate the vulnerability for now, users can disable uMatrix’s strict-blocking support by unselecting all of the filter lists on the "Assets" tab in the uMatrix dashboard. Subscribing to malware or multi-purpose filter lists may reduce the impact the change has on the blocking of the extension. The researcher notes that users need to disable all filter lists on the "assets" tab of the uMatrix dashboard. The uMatrix extension is not maintained anymore, which means that it is still vulnerable and will remain so. The maintainer of nMatrix published an update to the Pale Moon add-ons site that fixed the issue in the extension as well. Raymond Hill was notified before the security issue was disclosed publicly, and a fix was created for uBlock Origin within one day and published the next. Only the Chrome extension crashed during tests. The researcher tested a proof of concept vulnerability against Chrome, Firefox and Pale Moon. iframes are classified as sub-documents and do not trigger the warning page, which should make it harder for malicious hosts to exploit this vulnerability in the background. This means that malicious hosts would need to induce users to trigger a navigation somehow, such as by clicking a link. The strict-blocking warning page is only displayed when direct navigations are blocked. It requires that users become active, e.g. When the extension crashes, users are left without protection until it is reloaded. Default installations of the extensions use filter lists that include strict blocking filters.Īn attacker may exploit the vulnerability to get the extension to crash or cause memory exhaustion according to the researcher. Strict blocking prevents all connections to resources that match the filter. The vulnerability exploits code used by the extensions strict blocking feature. The Firefox extension, for which I wrote a guide in 2017, has more than 29,000 users at the time of writing.Ī security researcher discovered a vulnerability in all three extensions. ![]() Google's Chrome Web Store, on which it is still listed, reveals that it has more than 100,000 users, a figure that can be higher as Google does not echo total number of users to the public. The uMatrix browser extension is still in use. ![]()
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |