1

On my company device, Edge and Firefox ESR are installed by default and should be used as main browsers. Since I'm developing web applications, I use Firefox and Firefox Dev Edition regularly, which I installed by myself.

However both versions of Firefox are crashing from time to time (after 5 minutes or 2 hours for instance) for some weeks now. New profiles, complete reinstalls and safe mode didn't help to solve the issue.

Today the Windows event log came to my mind and I took a look at it. The crashes are logged and it blames the crash to the module PayloadRestrictions.dll.

How can I solve this issue? Keep in your mind that I have access to admin privileges, but GPOs still restrict some actions and I can/should not modify system files on my own. I don't want to increase the risk of system or security issues for my company.


System

Source: Application Error
EventID: 1000

Event data

Name der fehlerhaften Anwendung: firefox.exe, Version: 67.0.4.7109, Zeitstempel: 0x5d0adee5
Name des fehlerhaften Moduls: PayloadRestrictions.dll, Version: 10.0.17763.1, Zeitstempel: 0x7885c70a
Ausnahmecode: 0xc0000409
Fehleroffset: 0x000000000003b614
ID des fehlerhaften Prozesses: 0x3778
Startzeit der fehlerhaften Anwendung: 0x01d52802e9c15798
Pfad der fehlerhaften Anwendung: C:\Program Files\Mozilla Firefox\firefox.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\SYSTEM32\PayloadRestrictions.dll
Berichtskennung: [Guid]
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: 
1

The module PayloadRestrictions.dll is a Windows security feature, injected by Windows into all non-exempt processes. The feature that is causing your crashes is probably Export Address Filtering (EAF), defined as:

Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. App-level only

Here is how to disable it for Firefox:

  • In Start menu, launch Windows Security
  • Go to App & browser control
  • Scroll down to the Exploit protection section and click on Exploit protection settings
  • Switch from System settings to Program settings
  • Find firefox.exe in the list, click the entry to expand, then click Edit
  • Scroll down to Export address filtering (EAF)
  • Switch it to "Audit only" to stop the crashes. Turning it off entirely would probably also help.

You will need to repeat this process after every Firefox update.

| improve this answer | |
  • Upvote for this precise and promising answer. Sadly these options are locked and cannot be changed by normal user accounts. Do you know the reasons that could make the dll crash? The security feature per se should not constantly crash the browser, right? – Emaro Jun 21 '19 at 9:18
  • Your post specified that you had access to limited admin privileges. Perhaps, if you can, excluding the Firefox installation from Windows Defender might also do the trick. – harrymc Jun 21 '19 at 9:51
  • Yes, excuse me. With normal user I meant users of the common clients, even if they got admin rights. I think these settings only can be changed by the 'super admin' who stage the devices or something like that. I'll try that. It can also be, that I actually cannot do anything about the issue due to missing privileges. – Emaro Jun 21 '19 at 11:12
  • The Windows Defender settings are locked too... – Emaro Jun 21 '19 at 11:17
  • 1
    All that is left for me to recommend is fully patching Windows, besides begging the domain admin to give you the required permission (or to do it himself). – harrymc Jun 21 '19 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.