{"id":2820,"date":"2021-10-25T10:04:33","date_gmt":"2021-10-25T17:04:33","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2820"},"modified":"2021-10-25T23:43:45","modified_gmt":"2021-10-26T06:43:45","slug":"securing-the-proxy-api-for-firefox-add-ons","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2021\/10\/25\/securing-the-proxy-api-for-firefox-add-ons\/","title":{"rendered":"Securing the proxy API for Firefox add-ons"},"content":{"rendered":"

Add-ons are a powerful way to extend and customize Firefox. At Mozilla, we are committed not only to supporting WebExtensions APIs, but also ensuring the safety and reliability of the ecosystem for the long term.<\/p>\n

In early June, we discovered add-ons that were misusing the proxy API<\/a>, which is used by add-ons to control how Firefox connects to the internet. These add-ons interfered with Firefox in a way that prevented users who had installed them from downloading updates, accessing updated blocklists, and updating remotely configured content.<\/p>\n

In total these add-ons were installed by 455k users.<\/p>\n

This post outlines the steps we have taken to mitigate this issue as well as provide details of what users should do to check if they are affected. Developers of add-ons that use the proxy API will find some specific instructions below that are required for future submissions.<\/p>\n

 <\/p>\n

What have we done to address this?<\/h3>\n

The malicious add-ons were blocked, to prevent installation by other users.<\/p>\n

To prevent additional users from being impacted by new add-on submissions misusing the proxy API, we paused on approvals for add-ons that used the proxy API until fixes were available for all users.<\/p>\n

Starting with Firefox 91.1, Firefox now includes changes to fall back to direct connections when Firefox makes an important request (such as those for updates) via a proxy configuration that fails. Ensuring these requests are completed successfully helps us deliver the latest important updates and protections to our users. We also deployed a system add-on<\/a> named \u201cProxy Failover\u201d (ID: proxy-failover@mozilla.com) with additional mitigations that has been shipped to both current and older Firefox versions.<\/p>\n

 <\/p>\n

As a Firefox user, what should I do next?<\/h3>\n

It is always a good idea to keep Firefox up to date, and if you\u2019re using Windows to make sure Microsoft Defender<\/a> is running. Together, Firefox 93 and Defender will make sure you’re protected from this issue.<\/p>\n

First, check what version of Firefox you are running<\/a>. Assuming you have not disabled updates specifically, you should be running at minimum the latest release version<\/a>, which is Firefox 93 as of today (or Firefox ESR 91.2). If you are not running the latest version, and have not disabled updates, you might want to check if you are affected by this issue. First, try updating Firefox<\/a>. Recent versions of Firefox come with an updated blocklist that automatically disables the malicious add-ons. If that doesn\u2019t work, there are a few ways to fix this:<\/p>\n