Mozilla working on critical Firefox patch

Attack code to exploit the vulnerability, written by security researcher Guido Landi, appeared on several security websites on Wednesday.

The code could be modified by attackers to dupe users of the unpatched browser into viewing a malicious XML file that is then used to install unauthorised software.

The flaw is thought to affect all releases of Firefox 3.0, the most recent version of the browser, running on all popular operating systems, including Linux.

Mozilla had not responded to requests for comment at the time of writing, but a Firefox security developer said that the company is working on a patch.

The patch will be issued as part of Mozilla's upcoming Firefox 3.0.8, which is slated for release between 30 March and 1 April.

The patch has been characterised as a "high-priority fire drill" security update, because the attack code has been released publicly.

Such code rarely gets released into the wild, but this does not necessarily slow down the hackers, as the CanSecWest security conference proved last week.

Fully patched versions of Firefox, Safari and Internet Explorer all failed its annual hacking contest.