OK, I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?
replyThe article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited.
The os exploit is, within this context, after the fact and therefore a non sequitur. You should look up the Project Zero watering hole analysis where they revealed something like 17 0-days being delivered to visitors of one particular site. It's likely that citizen labs only had windows exemplars.
replyIt was a Windows exploit that ran. An adBlocker (funnily enough) would've been an excellent defense against this, given that the exploit ran in JavaScript served in targeted ads.
replyThough, there is a browser patch for this, don't advertise so much identifiable information that an advertiser can identify a user or their employer. That's the defense, but it'll never happen.