MozillaVPN: Elevation of Privilege via a Race Condition Vulnerability

Summary

A race condition vulnerability was discovered in Mozilla VPN which leads to local privilege escalation to root on macOS. The race condition existed when the application is being installed or updated, a local attacker can replace the VPN binary with a malicious one which is executed as root. The exploit requires access to the local device, such as a previous malware infection, therefore the issue was assigned with a medium severity.

The fix was released in version 2.20.