Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mozilla-mobile/mozilla-vpn-client

              main @ a80646c
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Code Signing Bypass: 4 prior fixes. Scrutinize any change in this area.

verification: most-fixed (2 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Signing Bypass: Unsigned daemon and wireguard-go binary could be installed and executed, bypassing code signing on macOS.

Privilege Escalation: Weak daemon installation and launch checks allowed privilege escalation; fixed by strengthening codesign requirements with OIDs and identifier checks.

Use-After-Free: DNS callback could access a destroyed connection context, leading to use-after-free.