CVE-2021-29970

What it actually does

Use-after-free vulnerability in the accessibility subsystem that leads to memory corruption and a potentially exploitable crash when a malicious webpage is rendered.

Why it matters to the business

Remote attackers could achieve code execution on user systems running affected Mozilla products with accessibility features enabled, resulting in data theft, ransomware deployment, or lateral movement within an organization.

How an attack unfolds

An attacker hosts a specially crafted webpage that, when visited by a user with accessibility enabled, triggers the use-after-free condition in Firefox, Firefox ESR, or Thunderbird, allowing memory manipulation and arbitrary code execution.

How to fix it

Upgrade Firefox to version 90 or later, Firefox ESR to 78.12 or later, and Thunderbird to 78.12 or later. Disable accessibility features if upgrades cannot be applied immediately.

How to confirm the fix worked

Verify product versions are at or above the fixed releases and confirm accessibility is either updated or disabled; test rendering of known trigger pages in a controlled environment.

Typical attack path

1. User enables accessibility features in the browser or email client
2. Attacker lures the user to a malicious webpage via phishing or compromised site
3. Webpage content triggers the use-after-free and memory corruption
4. Attacker gains control of the process to execute arbitrary code

How to detect it

Review browser and system crash logs for accessibility-related faults, inspect web request logs for visits to suspicious domains, and search endpoint telemetry for unexpected process behavior following web browsing activity.

What your security team should do

• Immediately deploy available updates to all instances of Firefox, Firefox ESR, and Thunderbird
• Audit environments for users with accessibility enabled and prioritize those systems
• Monitor for crash reports involving accessibility components
• Block known malicious domains associated with exploitation attempts