CVE-2021-43545

What it actually does

Repeated calls to the Location API in a loop trigger unbounded resource consumption leading to application hangs or crashes.

Why it matters to the business

Users experience sudden browser or email client freezes and crashes, interrupting work and requiring restarts; the issue is old with no active exploitation campaigns, so immediate operational disruption risk is low.

How an attack unfolds

An attacker crafts a web page or email that repeatedly invokes the Location API inside a tight JavaScript loop; when the victim visits the page or renders the message, the browser or client enters a resource-exhaustion state and becomes unresponsive.

How to fix it

Upgrade Firefox to 95 or later, Firefox ESR to 91.4.0 or later, and Thunderbird to 91.4.0 or later; apply vendor updates through normal channel or OS package manager.

How to confirm the fix worked

Confirm installed version meets or exceeds the fixed releases listed above; attempt to reproduce the loop behavior in a test environment and verify the application remains responsive.

Typical attack path

1. attacker hosts a malicious page or sends a crafted email containing JavaScript
2. victim opens the page or message in an affected Firefox, ESR, or Thunderbird version
3. script enters a tight loop calling the Location API
4. application UI freezes or the process terminates

How to detect it

Review browser crash logs and application hang reports for repeated Location API usage patterns; correlate with web or email access logs around the time of the incident.

What your security team should do

• Prioritize patching any remaining instances of Firefox < 95, ESR < 91.4.0, or Thunderbird < 91.4.0
• Block or sandbox untrusted web content and email rendering where updates cannot be applied immediately
• Monitor for new exploit maturity indicators even though current maturity is none