0.0.0.0 Day: Exploiting Localhost APIs From the Browser

Researchers at Oligo Security have disclosed a logical vulnerability to all major browsers (Chromium, Firefox, Safari) that enables external websites to communicate with (and potentially exploit) software that runs locally on MacOS and Linux. Windows is not impacted by this issue. Oligo Researchers have found that public websites (like domains ending in .com) are able to communicate with services running on the local network (localhost) and potentially execute arbitrary code on the visitor’s host by using the address 0.0.0.0 instead of localhost/127.0.0.1.

18-year-old security flaw in Firefox and Chrome exploited in attacks

Despite being reported in 2008, 18 years ago, this problem remains unresolved on Chrome, Firefox, and Safari, though all three have acknowledged the problem and are working towards a fix. Researchers at Oligo Security report that the risk not only makes attacks theoretically possible, but have observed multiple threat actors exploiting the vulnerability as part of their attack chains.