# MozillaVPN: Elevation of Privilege via a Race Condition Vulnerability

Race condition during Mozilla VPN install/update on macOS lets a local attacker swap the VPN binary for a malicious one executed as root.

- Payout: hidden
- Severity: medium
- Program: Mozilla
- Found by: northsea
- Disclosed: 2025-07-03
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2261577
- Library page: https://bugbountylibrary.com/r/h1%3A2261577
- Tags: area:os domain:desktop impact:privesc kind:bounty platform:hackerone sev:medium technique:race-window vuln:privilege-escalation vuln:race-condition

**Target:** macOS VPN client installer/updater
**Root cause:** Installer/updater writes or executes the VPN binary without proper synchronization, leaving a window where a local attacker can replace the binary before it runs as root.
**Steps:**
1. Obtain local access to the macOS device (e.g. prior malware).
2. Trigger Mozilla VPN install or update.
3. During the install/update window, replace the VPN binary with a malicious binary.
4. Installer executes the swapped binary as root, yielding privilege escalation.
**Exploitation:** Local attacker with existing device access races the installer/updater, substituting the VPN binary so the privileged install/update process executes attacker code as root.
**Insight:** Install/update flows that run binaries as root are prime race targets: look for a TOCTOU window between binary placement and privileged execution, especially in updaters that write to predictable paths.