CVE-2021-43539

What it actually does

Incorrect recording of live pointers across WebAssembly instance calls allows a garbage collection event during the call to skip tracing, resulting in a use-after-free that can be leveraged for memory corruption and remote code execution.

Why it matters to the business

Attackers can crash browsers or execute arbitrary code on user systems via crafted web content or email, risking data theft, ransomware deployment, and loss of user trust across desktop and enterprise environments.

How an attack unfolds

An attacker hosts or sends a malicious page or message containing WebAssembly code that invokes an instance call while live pointers exist; when garbage collection is triggered inside the call the untraced pointers become dangling, enabling the attacker to corrupt memory and achieve code execution in the renderer process.

How to fix it

Upgrade Mozilla Firefox to version 95 or later, Firefox ESR to 91.4.0 or later, and Thunderbird to 91.4.0 or later. Apply vendor updates as soon as they become available and verify installed versions against the fixed releases.

How to confirm the fix worked

Confirm the installed browser or email client version meets or exceeds the fixed releases; re-test affected WebAssembly scenarios in a controlled environment and monitor for absence of the previously observed crash signatures.

Typical attack path

1. Deliver malicious WebAssembly content via compromised or attacker-controlled website or email attachment
2. Victim browser parses and executes the WebAssembly instance call
3. Garbage collection occurs inside the call before live pointers are correctly recorded
4. Use-after-free is triggered allowing memory corruption
5. Attacker chains corruption to achieve arbitrary code execution or browser crash

How to detect it

Search browser process crash reports and telemetry for use-after-free signatures involving WebAssembly instance calls; review web proxy and email gateway logs for delivery of content that triggers WASM execution followed by renderer instability.

What your security team should do

• Prioritize immediate patching of all Firefox, ESR, and Thunderbird instances across the organization
• Enable automatic updates where possible and enforce version checks in endpoint management tools
• Review and restrict WebAssembly usage in high-risk internal applications until patches are deployed
• Update incident response playbooks to include browser renderer process crash investigation