This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Wo archive tread sia. Meɖekuku bia biabia yeye ne ehia kpeɖeŋu.

Apache Log4J Critical Vulnerability

milo.fisk
milo.fisk
more options

Good afternoon,

Is there an impact to the Mozilla Firefox application from the newly discovered Apache Log4J Critical Vulnerability (Log4J version 2.14.1 CVE-2021-44228)?

Can you please confirm if Mozilla Firefox is exposed to this vulnerability and if it is, then do you have an availability date of the patch to your codes?

Thanks, Milo

Good afternoon, Is there an impact to the Mozilla Firefox application from the newly discovered Apache Log4J Critical Vulnerability (Log4J version 2.14.1 CVE-2021-44228)? Can you please confirm if Mozilla Firefox is exposed to this vulnerability and if it is, then do you have an availability date of the patch to your codes? Thanks, Milo

All Replies (3)

Amelia
Amelia
more options

Hello,

I do not believe that this exploit was ever possible (except for java web applets), as Firefox is written in c++ (I believe there is rust in there too)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

This is about a specific Apache application that companies can run to log details about visitors on their servers. Firefox is a web browser and doesn't use this software, so unless you own a website that uses this Apache Log4J software then there is nothing to worry.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Hi Milo, if you conduct a search for log4j in the Firefox source code on https://searchfox.org/mozilla-release/source/, you will find that Firefox uses a JavaScript module named log4js. Despite the name similarity, from what I read, it does not have the problematic features of the log4j Java program. Here's what I found:

Let me know if you discover anything concerning.