A freshly discovered “zero day” vulnerability in the Firefox browser is currently being exploited and – if you are using Windows – can compromise your computer simply by visiting otherwise benign web sites. Fortunately, the exploit was published rather quickly and the Firefox team was able to issue a security patch within a few hours.
However – the exploit uses benign websites (especially ones that are commonly used as starting pages for browser sessions) as “watering holes” and any use at all of previous versions of Firefox is contraindicated until you download and install the newest release. If you use Firefox you need to immediately switch to another browser such as Safari or Chrome until you update Firefox. You can get the update here:
Firefox 50.0.2 Release Notes And Download
If you use Thunderbird for your email you also need to update as it uses the same Mozilla engine for parsing HTML within email messages. This is only a concern if you have Thunderbird set to allow inline content to be displayed automatically or you manually select content to load, but it would be in your best interest to update regardless:
Thunderbird 45.5.1 Release Notes And Download
Finally, if you use the Tor browser and security package, you also need to update as it contains a discrete version of the Mozilla engine that is affected by the same exploit:
Tor Browser 6.0.7 Release Notes And Download
Remember – you should not use either Firefox or Tor for any reason, even to download the updates, until you have the newest versions installed. Kudos to the Firefox/Mozilla team for getting these updates out so quickly. If you are interested in how the nuts and bolts of this works, there is an excellent write-up along with some pro analysis at the Wordfence Blog.