Dan Guido

MWR published research in this area years ago in WebKit, and it appears that Firefox is lagging a few years behind. https://labs.mwrinfosecurity.com/blog/mwr-labs-pwn2own-2013-write-up-webkit-exploit/ …

As far as exploit techniques, this is a routine UAF that heap sprays a controlled object to kick off a ROP chain. Pwn2Own 2012-level tech.

The controlled object eventually gives them RW access to memory, then its game over.

This is not an advanced exploit. If you want to see one of those, check out Pegasus which had to deal with code signing and JIT pages.

This type of exploit is much harder to write in Chrome and Edge due to memory partitioning, an exploit mitigation that Firefox lacks.

If you thought this exploit was from MSF, it's not. MSF has 8 Firefox exploits, none of them match this new one.

The vulnerability is present on macOS, but the exploit does not include support for targeting any operating system but Windows.