CVE-2021-43536

What it actually does

Asynchronous functions under certain conditions cause navigation to fail while still exposing the intended target URL to the caller or observers.

Why it matters to the business

Potential leakage of sensitive or internal URLs can reveal user browsing intent, internal application paths, or resources that should remain private, increasing risk of targeted follow-on attacks.

How an attack unfolds

An attacker hosts or injects content that triggers asynchronous navigation in the affected browser; when the navigation fails, the target URL is disclosed, allowing the attacker to capture it for reconnaissance or further exploitation.

How to fix it

Upgrade Mozilla Firefox to version 95 or later, Firefox ESR to 91.4.0 or later, and Thunderbird to 91.4.0 or later. Apply vendor patches as soon as available for all affected installations.

How to confirm the fix worked

Verify installed browser versions meet or exceed the fixed releases; re-test navigation failure scenarios in a controlled environment to confirm URLs are no longer exposed.

Typical attack path

1. Serve or inject a page containing crafted asynchronous navigation code
2. Induce navigation failure conditions in the victim browser
3. Capture the exposed target URL from the failure path
4. Use disclosed URL for targeted phishing, resource enumeration, or lateral movement

How to detect it

Review browser process logs, crash reports, and any custom telemetry for unexpected navigation failure events that include URL data; correlate with web proxy or endpoint logs showing unusual outbound requests to attacker-controlled domains shortly after browser activity.

What your security team should do

• Prioritize immediate upgrade of all Firefox, ESR, and Thunderbird instances to the fixed versions
• Inventory and patch third-party or embedded browser components across the environment
• Update vulnerability management policies to accelerate browser patch deployment
• Monitor vendor advisories for any related regressions or follow-on issues