CVE-2017-5428

What it actually does

Integer overflow in createImageBitmap() enables memory corruption within the browser content sandbox process.

Why it matters to the business

Attackers can leverage malicious websites to corrupt memory in user browsers, potentially leading to full system compromise when chained with a second vulnerability; the issue affects widely deployed Firefox versions across enterprise and consumer environments.

How an attack unfolds

An attacker hosts a crafted webpage that invokes the vulnerable createImageBitmap API with specially chosen parameters to trigger the integer overflow and achieve memory corruption inside the sandboxed content process; successful exploitation requires a second vulnerability to escape the sandbox and gain code execution on the host.

How to fix it

Upgrade Mozilla Firefox to version 52.0.1 or later and Firefox ESR to 52.0.1 or later; apply vendor updates to any Red Hat Enterprise Linux packages that bundle affected Firefox binaries.

How to confirm the fix worked

Query installed Firefox version strings on endpoints and compare against 52.0.1; review browser update logs and enterprise software deployment reports to confirm patches are applied.

Typical attack path

1. User visits attacker-controlled or compromised website
2. Malicious JavaScript calls createImageBitmap with overflow-triggering inputs
3. Integer overflow produces memory corruption in the content sandbox
4. Attacker chains with a separate sandbox-escape exploit to achieve arbitrary code execution

How to detect it

Examine web proxy and browser process creation logs for unexpected child processes spawned from Firefox after visits to high-risk sites; look for crash reports or memory corruption indicators in Firefox telemetry or system crash dumps around the time of suspected exploitation.

What your security team should do

• Prioritize rapid deployment of Firefox 52.0.1+ across all managed systems
• Enable automatic browser updates where policy permits
• Restrict execution of untrusted web content via application allow-listing or browser isolation controls until updates are complete