Security News > 2020 > March > Vulnerability Prompts Avast to Disable Emulator Used by Antivirus
Avast this week disabled a JavaScript interpreter that is part of its antivirus product, after a security researcher discovered a vulnerability that could potentially lead to remote code execution.
Despite being a high-privilege process running untrusted input, the emulator was not sandboxed and also had poor mitigation coverage, Ormandy discovered.
Two days later, Avast decided to disable the emulator globally, to ensure that it does not pose a security threat to users.
"Last week, reported a vulnerability to us in one of our emulators, which in theory could have been abused for RCE. On [March 9] he released a tool to simplify vuln. analysis in the emulator. Today, to protect our hundreds of millions of users, we disabled the emulator," Avast announced.
Earlier this week, Avast and security researcher David Eade publicly disclosed information on a series of issues in the Avast AntiTrack solution that could have been abused to perform man-in-the-middle attacks on HTTPS traffic.