CVE-2015-2706

What it actually does

Race condition in AsyncPaintWaitEvent initialization allows a crafted plugin to trigger use-after-free, resulting in arbitrary code execution or denial of service within the browser process.

Why it matters to the business

Attackers could gain control over user systems running outdated browser versions, leading to data theft, malware installation, or browser crashes that disrupt user workflows on legacy deployments.

How an attack unfolds

An attacker delivers a malicious webpage embedding a plugin that intentionally delays or skips proper initialization; the resulting timing window in the AsyncPaintWaitEvent handler causes a use-after-free that the attacker leverages for code execution.

How to fix it

Upgrade Mozilla Firefox to version 37.0.2 or later; disable or restrict plugin loading for environments that cannot update immediately.

How to confirm the fix worked

Confirm the installed Firefox version is 37.0.2 or newer; test that the browser no longer crashes or executes arbitrary code when loading the original proof-of-concept plugin under controlled conditions.

Typical attack path

1. Host a webpage containing a specially crafted plugin that withholds initialization completion
2. Trigger the AsyncPaintWaitEvent code path in the target browser
3. Exploit the use-after-free primitive to corrupt memory and execute attacker-controlled code
4. Establish persistence or exfiltrate data from the compromised browser process

How to detect it

Review browser crash logs and plugin initialization events for timing anomalies or use-after-free indicators; correlate with web requests that embed unusual plugin content.

What your security team should do

• Prioritize patching all Firefox instances to 37.0.2 or newer
• Audit plugin usage policies and block untrusted plugins where possible
• Monitor for browser process crashes correlated with plugin activity in legacy environments