It's unclear whether Haddouche released the POC code on GitHub before or after he received a response from Mozilla that identified the bug as a duplicate. The issue reported by Haddouche is being tracked as bug 1493539 on Bugzilla, and it's listed as a duplicate of the earlier bug 1438214. 'It is similar, but I wouldn't say the same,' he said. However, the researcher disagreed that it's a duplicate. According to Haddouche, Mozilla said this issue is a duplicate of another bug reported in February 2018. Haddouche said he notified Mozilla about the POC 'a few hours before' the POC went live on Sunday. In order to launch the Browser Reaper attack, the victim would have to visit a webpage that contains the source code. (and yes, it includes a crash / freeze for Firefox and its source code as promised) /Q6UlBWIXe6 - Sabri 23, 2018 In both cases, it triggered the Mozilla Crash Reporter notification, which Haddouche included in his Tweet. Haddouche tested this version of Browser Reaper on Linux and Mac systems. The file attempts to download once every millisecond on a continuous loop, which overwhelms the interprocess communication channel and eventually results in the browser freezing or crashing.

The source code for the Firefox version of Browser Reaper uses JavaScript and generates a file with a long name. Haddouche has also created exploits that could crash an iPhone using CSS and HTML.

This series of exploits is called Browser Reaper, and the latest one for Mozilla works on Firefox versions 62.0.2 and earlier.

Mozilla thunderbird keeps freezing up