Part 2/4:

To illustrate this concept, the video presents a simple C code example. The code defines two structures, cat and dog, each with an ID and a function pointer. Two global pointers, Randy and Frank, are used to reference these structures. The video then demonstrates how, by freeing the Frank pointer and then creating a new cat object, the program can end up with a type confusion, where the Frank pointer now points to the memory of the Randy object. This allows an attacker to potentially control the function pointer and execute arbitrary code.

The Impact on Firefox and Tor

The vulnerability discovered by the research company EET specifically targets the way Firefox handles animation timelines in CSS. By crafting malicious CSS, an attacker can exploit this use-after-free vulnerability and gain remote code execution on the affected system.

[...]