CVE-2021-29981

What it actually does

A flaw in the JIT compiler's lowering and register allocation phase causes deterministic register confusion in generated machine code, resulting in memory corruption that can lead to an exploitable crash.

Why it matters to the business

Attackers could gain remote code execution on user systems running vulnerable browser or email client versions, enabling data theft, malware deployment, or further network compromise without requiring user privileges beyond visiting a malicious page.

How an attack unfolds

An attacker serves a specially crafted webpage that forces the browser's JIT engine to compile code in a way that triggers the register allocation error; the resulting memory corruption is leveraged to hijack control flow and execute attacker-supplied code.

How to fix it

Upgrade Mozilla Firefox and Thunderbird to version 91 or later; verify that all installations have been updated and remove or isolate any remaining older versions.

How to confirm the fix worked

Confirm installed versions are 91 or newer via the browser's about:support or about:buildconfig pages; attempt to reproduce the original crash condition in a controlled test environment if feasible.

Typical attack path

1. Attacker hosts a malicious webpage designed to trigger JIT compilation
2. Victim opens the page in an affected Firefox or Thunderbird version
3. Register confusion occurs during code generation leading to memory corruption
4. Attacker exploits the corruption to achieve code execution

How to detect it

Review browser crash reports and logs for entries referencing JIT compilation or register allocation failures; correlate with network logs showing visits to suspicious domains around the time of any unexpected crashes.

What your security team should do

• Immediately deploy updates to version 91 or later across all endpoints
• Block or filter access to known malicious domains used in browser-targeted campaigns
• Enable crash reporting and monitor for JIT-related process failures
• Review and harden browser sandbox configurations where possible