- The "0.0.0.0 Day" flaw lets attackers bypass browser security and access local networks.
- Major browsers are racing to block this vulnerability, but it's still exploitable.
- Hackers can use this flaw for unauthorized access and remote code execution.
Oligo Security’s research team discovered a critical vulnerability known as 0.0.0.0 Day that allows hackers to bypass browser security and interact with services on an organization’s local network.
This vulnerability allows attackers to gain unauthorized access and even execute remote code on local services from outside the network.
The problem stems from inconsistent security mechanisms across browsers and a lack of industry standardization.
Now the seemingly innocent IP address 0.0.0.0 becomes a valuable tool for hackers to exploit, affecting both individuals and organizations.
0.0.0.0 Is a Hacker’s New Best Friend
You might think 0.0.0.0 is a harmless IP address, but hackers disagree. Oligo Security discovered that this address can be used to communicate with services running on the local network.
Typically, browsers block external websites from accessing local services. However, by using 0.0.0.0 instead of the standard localhost (127.0.0.1), hackers can trick the browser into allowing this communication.
Simply put, this flaw allows hackers to gain access to your network through your browser’s back door.
If you are still unsure how serious this is, consider the ShadowRay campaign. Hackers have already begun exploiting this vulnerability in active campaigns.
They exploit 0.0.0.0 to gain unauthorized access to services running on local devices, endangering sensitive data and internal networks.
The fact that this flaw is being actively exploited makes it a critical issue for both individuals and businesses.
Browsers Are Playing Catch-Up
Since Oligo Security responsibly disclosed this vulnerability to major browsers back in April 2024, Google, Apple, and Mozilla have been scrambling to patch it.
Google Chrome has already begun blocking access to 0.0.0.0, with a full rollout expected in Chrome version 133.
Apple’s Safari quickly updated its WebKit framework, adding a check to block 0.0.0.0 requests.
Meanwhile, Mozilla Firefox has yet to fully implement the fix, as it did not restrict Private Network Access (PNA) in the first place.
Firefox intends to block 0.0.0.0 in the future, but has not specified a timeframe.
So, why can’t browsers simply patch this and call it quits? The answer comes from the lack of a finalized standard for how browsers handle internal network requests.
Each browser currently handles these requests differently, making it difficult to create a universal solution.
Google’s Private Network Access (PNA) initiative seeks to address this issue, but the 0.0.0.0 vulnerability circumvented PNA mechanisms, demonstrating that even sophisticated security measures can be defeated.
While steps are being taken to prevent access to 0.0.0.0, the vulnerability remains exploitable, putting millions at risk.
This loophole allows public websites to send requests to local networks, and it only takes one malicious HTTP request to gain access to your internal services.