CVE-2021-43535

What it actually does

Use-after-free in HTTP2 session object when released across threads, resulting in memory corruption and exploitable crash.

Why it matters to the business

Remote attackers could crash browsers or achieve code execution on unpatched Mozilla products, risking data exposure or compromise. The vulnerability is nearly five years old with no KEV listing or ransomware use, indicating low current risk for organizations running supported versions.

How an attack unfolds

An attacker serves crafted HTTP2 responses to a victim browser, exploiting thread timing to free a session object still in use on another thread, leading to memory corruption that may be leveraged for code execution. No public exploit maturity or named threat actors are associated.

How to fix it

Update Firefox to 93 or newer, Thunderbird to 91.3 or newer, and Firefox ESR to 91.3 or newer. Apply vendor patches or upgrade affected Debian packages to current releases.

How to confirm the fix worked

Verify installed product versions meet or exceed the fixed releases listed in the advisory; test HTTP2 session handling under concurrent thread conditions if source-level validation is required.

Typical attack path

1. Send malicious HTTP2 traffic to target browser
2. Trigger race condition during session release on separate threads
3. Corrupt memory to achieve crash or arbitrary code execution

How to detect it

Inspect browser crash reports and logs for memory corruption signatures tied to HTTP2 session handling; correlate unexpected process exits following web requests.

What your security team should do

• Confirm all Mozilla browser and email client instances are on supported, patched releases
• Include Mozilla products in routine vulnerability scanning and patch management
• Review EPSS trend and re-evaluate if exploit maturity increases