A denial of service vulnerability in Cyberfox Web Browser 52.9.1 allows local attackers to crash the application by submitting a malformed 9,000,000 byte payload into the search bar.

The application lacks proper resource allocation limits, specifically regarding input handling in the search bar. This allows an attacker to trigger a crash by providing a 9,000,000 byte string, effectively exhausting memory resources.

While the CVSS score of 7.5 indicates a high severity rating, the impact is primarily localized to the availability of the browser session. Successful exploitation results in the immediate termination of the application, which may cause data loss for the user and requires a manual restart of the browser. This vulnerability is particularly disruptive in environments where browser stability is critical for continuous workflow operations.

Immediate Action: As no official patch is currently available, users should restrict access to the affected system and avoid inputting untrusted or excessive data into the browser search bar.

Proactive Monitoring: Security teams should monitor system logs for frequent application crashes or unexpected termination of the browser process.

Compensating Controls: Implement endpoint security policies to restrict the execution of unauthorized or legacy software versions within the enterprise environment.

Public Exploit Available: Yes, a proof-of-concept Python script is available via Exploit-DB (EDB-ID: 50336).

Given the lack of vendor-provided security updates for this legacy software, the primary recommendation is to migrate to a modern, actively maintained web browser. If the application must remain in use, enforce strict physical and logical access controls to the host system to prevent unauthorized local users from triggering the crash condition.