CVE-2022-40957

What it actually does

Inconsistent instruction and data cache state during WebAssembly code generation on ARM64 processors triggers memory corruption that can result in an exploitable crash.

Why it matters to the business

Attackers can remotely crash browser sessions on ARM64 systems, causing service interruptions for users on affected Mozilla products and increasing support overhead.

How an attack unfolds

An attacker crafts a malicious webpage containing WebAssembly that triggers cache inconsistency when loaded in Firefox or Thunderbird on ARM64; the resulting crash may be leveraged for further memory manipulation.

How to fix it

Upgrade Firefox to version 105 or later, Firefox ESR to 102.3 or later, and Thunderbird to 102.3 or later on all ARM64 systems.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases and test WebAssembly execution on ARM64 hardware for stability.

Typical attack path

1. Victim visits attacker-controlled site with malicious WebAssembly
2. Browser compiles WASM code exposing cache inconsistency on ARM64
3. Memory corruption occurs leading to crash or potential code execution

How to detect it

Review browser crash logs and telemetry for WebAssembly-related faults on ARM64 devices; correlate with web request logs to attacker-controlled domains.

What your security team should do

• Prioritize patching all ARM64 deployments of affected Mozilla products
• Monitor EPSS trend for any future increase in exploit likelihood
• Block untrusted WebAssembly content via enterprise policies until patched