Malware

Mozilla drops Firefox add-on installed by 455,000 for blocking updates

Mozilla has removed two Firefox extensions called ‘Bypass’ and ‘Bypass XM’ from the Add-ons store.

Both of these add-ons were caught abusing Firefox’s proxy API that enables developers to intercept web requests and determine whether and how to proxy them. The addons blocked access to the latest web browser updates, up-to-date access lists, and content:

“In early June, we discovered add-ons that were misusing the proxy API, which is used by add-ons to control how Firefox connects to the internet. These add-ons interfered with Firefox in a way that prevented users who had installed them from downloading updates, accessing updated blocklists, and updating remotely configured content,” explain Mozilla engineering managers Rachel Tublitz and Stuart Colville in a blog post.

Both ‘Bypass’ and ‘Bypass XM’ were seen to be in use by 455,000 Firefox users.

Additional reporting by BleepingComputer revealed that the extensions were possibly “using a reverse proxy to bypass paywalled sites,” although Mozilla didn’t share any additional insights into the malicious nature of addons. “The add-ons also had Mozilla’s domain in the paywall list which inadvertently also blocked browser updates,” states the same report.

Checking if you are affected How to remove these add-ons

Fortunately, the add-ons are no longer on the Firefox Add-ons store. And, to deter the possibility of any mischievous ones from popping up, Mozilla has temporarily suspended accepting extensions that make use of Firefox’s proxy API.

At this time, Microsoft Defender appears to be the only antivirus solution detecting the add-ons.

If you’re using the up-to-date Firefox version 93, add-ons that misuse the proxy API are already blocked. If you are not, follow the update instructions to get the latest version of Firefox.

“Starting with Firefox 91.1, Firefox now includes changes to fall back to direct connections when Firefox makes an important request (such as those for updates) via a proxy configuration that fails. Ensuring these requests are completed successfully helps us deliver the latest important updates and protections to our users. We also deployed a system add-on named ‘Proxy Failover’ (ID: proxy-failover@mozilla.com) with additional mitigations that has been shipped to both current and older Firefox versions,” states Mozilla’s blog post.

The system addon ‘Proxy Failover’ deployed in Firefox releases will ensure that access to browser updates and essential content (like blocklists) is not hampered or deliberately halted by a malicious add-on.

Manually removing add-ons

To check if you are impacted, navigate to the Troubleshooting Information section by entering “about:support” in the Mozilla Firefox address bar.

Scroll down to the “Add-ons” section, and see if either of the following entries appear:

  • Name: Bypass, ID: {7c3a8b88-4dc9-4487-b7f9-736b5f38b957}
  • Name: Bypass XM, ID: {d61552ef-e2a6-4fb5-bf67-8990f0014957}

The presence of either or both of these entries indicates you are affected. If updating your browser to the latest version isn’t feasible, you may manually remove these add-ons. Users should also consider refreshing Firefox and resetting all add-ons.

Ax Sharma

Ax Sharma is a UK-based security researcher, journalist and TV subject matter expert experienced in malware analysis and cybercrime investigations. His areas of interest include open source software security and threat intel analysis. Frequently featured by leading media outlets like the BBC, Channel 5, Fortune, WIRED, The Register, among others, Ax is an active community member of the OWASP Foundation and the British Association of Journalists (BAJ).

Recent Posts

ParkMobile’s $32.8 Million Data Breach Settlement = You get $1?

In 2021, parking app ParkMobile suffered a massive data breach impacting 22 million users whose…

1 day ago

8 Brutal Truths About Cybersecurity I Wish I Knew

When I first got into cybersecurity, I thought it was all about hackers in hoodies…

2 days ago

US Air Force Probes Potential SharePoint-Linked Privacy Breach

The US Air Force is investigating a “privacy-related issue” that may have exposed personally identifiable…

4 days ago

Harrods third-party breach exposes 430,000 customer records, hackers reach out

London’s iconic department store Harrods has disclosed that approximately 430,000 customer records were compromised in…

6 days ago

WestJet confirms customer ID, passports stolen in June cyberattack

WestJet confirmed that in a June 2025 cybersecurity incident, a “sophisticated, criminal third party” gained…

6 days ago

Did You Also Get a ‘Real’ Phishing Email From GitHub.com?

Imagine getting an email straight from GitHub’s own notification system: the same one you've trusted…

1 week ago

This website uses cookies.