4 ms·

So basically Firefox is not affected ?

jsheard 8mo ago
Firefox and Safari are fine in this case, yeah.
DetroitThrow 8mo ago
It's pretty hard to have an accidental a use after free in the FireFox CSS engine because it is mostly safe Rust. It's possible, but very unlikely.
- topspin 8mo ago
  That came to my mind as well. CSS was one of the earliest major applications of Rust in FireFox. I believe that work was when the "Fearless Concurrency" slogan was popularized.
  - koito17 8mo ago
    Yup. To this day, Firefox remains the only browser with a *parallel* CSS engine. Chromium and WebKit teams have considered this and decided not to pursue since it's really easy to get concurrency wrong. If I recall correctly, the CSS engine was originally developed for Servo and later embedded into Firefox.
- moritzwarhier 8mo ago
  Firefox and Safari developers dared the Chromium team to implement :has() and Houdini and this is the result! /s
hdgvhicv 8mo ago
The listed browsers are basically skins on top of the same chromium base. It’s why Firefox and Safari as so important despite HN’a wish they’d go away.
- wvbdmp 8mo ago
  Particularly weird impulse for technically inclined people… Although I must admit to the guilty pleasure of gleefully using Chromium-only features in internal apps where users are guaranteed to run Edge.
  - hdgvhicv 8mo ago
    Are you old enough to have suffered through the ie6 corporate mess?
- autoexec 8mo ago
  HN doesn't want firefox to go away. HN wants firefox to be better, more privacy/security focused, and to stop trying to copy chrome out of the misguided hope that being a poor imitation will somehow make it more popular. Sadly, mozilla is now an adtech company (https://www.adexchanger.com/privacy/mozilla-acquires-anonym-a-privacy-tech-startup-founded-by-two-top-former-meta-execs/ https://www.adexchanger.com/privacy/mozilla-acquires-anonym-...) and by default firefox now collects your data to sell to advertisers. We can expect less and less privacy for firefox users as Mozilla is now fully committed to trying to profit from the sale of firefox users personal data to advertisers.
  - ddtaylor 8mo ago
    As a 25 year Firefox user this is spot on. I held out for 5 years hoping they would figure something out, but all they did was release weird stuff like VPNs and half baked services with a layer of "privacy" nail polish. Brave is an example of a company doing some of the same things, but actually succeeding it appears. They have some kind of VPN thing, but also have Tor tabs for some other use cases. They have some kind of integration with crypto wallets I have used a few times, but I'm sure Firefox has a reason they can't do that or would mess it up. You can only watch Mozilla make so many mistakes while you suffer a worse Internet experience. The sad part is that we are paying the price now. All of the companies that can benefit from the Chrome lock in are doing so. The web extensions are neutered - and more is coming - and the reasons are exactly what you would expect: more ads and weird user hostile features like "you must keep this window in the foreground" that attempt to extract a "premium" experience from basic usage. Mozilla failed and now the best we have is Brave. Soon the fingerprinting will be good enough Firefox will be akin to running a Tor browser with a CAPTCHA verification can for every page load.
zozbot234 8mo ago
Firefox is safe from this because their CSS handling was the first thing they rewrote in Rust.
- bawolff 8mo ago
  I mean, even if it was written in c or c++, its unlikely two separate code bases would have the exact same use after feee vuln.
  - jacquesm 8mo ago
    It's unlikely, but it does actually happen. I've seen more than one complete rewrite of something important that had exactly the same bug. And I'm very sure that those sources were not related somehow.
- ceteia 8mo ago
  Does the Rust implementation not use any unsafe and does not use libraries using unsafe?
  - nish__ 8mo ago
    No. What would be the point of that?
    - ceteia 8mo ago
      Not Firefox, but Servo has quite a lot of unsafe, even though some of the results are false positives. https://grep.app/search?f.repo=servo%2Fservo&f.repo.pattern=servo&q=unsafe https://grep.app/search?f.repo=servo%2Fservo&f.repo.pattern=... So Servo at the very least cannot be said to be 'safe'. And I believe the Rust code in Firefox is similar.
dzhiurgis 8mo ago
Yes, because nobody uses it
vntok 8mo ago
No, though Firefox has its own CVE this week: https://thecyberexpress.com/firefox-v147-cve-2026-2447/ https://thecyberexpress.com/firefox-v147-cve-2026-2447/

Firefox and Safari are fine in this case, yeah.

It's pretty hard to have an accidental a use after free in the FireFox CSS engine because it is mostly safe Rust. It's possible, but very unlikely.

topspin 8mo ago
That came to my mind as well. CSS was one of the earliest major applications of Rust in FireFox. I believe that work was when the "Fearless Concurrency" slogan was popularized.
- koito17 8mo ago
  Yup. To this day, Firefox remains the only browser with a *parallel* CSS engine. Chromium and WebKit teams have considered this and decided not to pursue since it's really easy to get concurrency wrong. If I recall correctly, the CSS engine was originally developed for Servo and later embedded into Firefox.
moritzwarhier 8mo ago
Firefox and Safari developers dared the Chromium team to implement :has() and Houdini and this is the result! /s

hdgvhicv 8mo ago

The listed browsers are basically skins on top of the same chromium base. It’s why Firefox and Safari as so important despite HN’a wish they’d go away.

wvbdmp 8mo ago
Particularly weird impulse for technically inclined people… Although I must admit to the guilty pleasure of gleefully using Chromium-only features in internal apps where users are guaranteed to run Edge.
- hdgvhicv 8mo ago
  Are you old enough to have suffered through the ie6 corporate mess?
autoexec 8mo ago
HN doesn't want firefox to go away. HN wants firefox to be better, more privacy/security focused, and to stop trying to copy chrome out of the misguided hope that being a poor imitation will somehow make it more popular. Sadly, mozilla is now an adtech company (https://www.adexchanger.com/privacy/mozilla-acquires-anonym-a-privacy-tech-startup-founded-by-two-top-former-meta-execs/ https://www.adexchanger.com/privacy/mozilla-acquires-anonym-...) and by default firefox now collects your data to sell to advertisers. We can expect less and less privacy for firefox users as Mozilla is now fully committed to trying to profit from the sale of firefox users personal data to advertisers.
- ddtaylor 8mo ago
  As a 25 year Firefox user this is spot on. I held out for 5 years hoping they would figure something out, but all they did was release weird stuff like VPNs and half baked services with a layer of "privacy" nail polish. Brave is an example of a company doing some of the same things, but actually succeeding it appears. They have some kind of VPN thing, but also have Tor tabs for some other use cases. They have some kind of integration with crypto wallets I have used a few times, but I'm sure Firefox has a reason they can't do that or would mess it up. You can only watch Mozilla make so many mistakes while you suffer a worse Internet experience. The sad part is that we are paying the price now. All of the companies that can benefit from the Chrome lock in are doing so. The web extensions are neutered - and more is coming - and the reasons are exactly what you would expect: more ads and weird user hostile features like "you must keep this window in the foreground" that attempt to extract a "premium" experience from basic usage. Mozilla failed and now the best we have is Brave. Soon the fingerprinting will be good enough Firefox will be akin to running a Tor browser with a CAPTCHA verification can for every page load.

zozbot234 8mo ago

Firefox is safe from this because their CSS handling was the first thing they rewrote in Rust.

bawolff 8mo ago
I mean, even if it was written in c or c++, its unlikely two separate code bases would have the exact same use after feee vuln.
- jacquesm 8mo ago
  It's unlikely, but it does actually happen. I've seen more than one complete rewrite of something important that had exactly the same bug. And I'm very sure that those sources were not related somehow.
ceteia 8mo ago
Does the Rust implementation not use any unsafe and does not use libraries using unsafe?
- nish__ 8mo ago
  No. What would be the point of that?
  - ceteia 8mo ago
    Not Firefox, but Servo has quite a lot of unsafe, even though some of the results are false positives. https://grep.app/search?f.repo=servo%2Fservo&f.repo.pattern=servo&q=unsafe https://grep.app/search?f.repo=servo%2Fservo&f.repo.pattern=... So Servo at the very least cannot be said to be 'safe'. And I believe the Rust code in Firefox is similar.

dzhiurgis 8mo ago

Yes, because nobody uses it

vntok 8mo ago

No, though Firefox has its own CVE this week: https://thecyberexpress.com/firefox-v147-cve-2026-2447/ https://thecyberexpress.com/firefox-v147-cve-2026-2447/