CVE-2022-40960

What it actually does

Concurrent use of the URL parser with non-UTF-8 data is not thread-safe, resulting in a use-after-free that can cause a crash which may be exploitable for remote code execution.

Why it matters to the business

Affected browser and email client software may experience unexpected crashes or allow attackers to execute arbitrary code, potentially disrupting user operations and exposing systems to further compromise.

How an attack unfolds

An attacker supplies specially crafted non-UTF-8 data that triggers concurrent URL parsing operations; the resulting use-after-free condition is leveraged to corrupt memory and achieve code execution or a denial-of-service crash.

How to fix it

Upgrade Mozilla Firefox to version 105 or later, Firefox ESR to 102.3 or later, and Thunderbird to 102.3 or later to eliminate the race condition in the URL parser.

How to confirm the fix worked

Verify installed versions meet or exceed the fixed releases and confirm the absence of crash signatures tied to URL parsing under concurrent non-UTF-8 workloads.

Typical attack path

1. Deliver non-UTF-8 data via network request or local input that invokes URL parsing
2. Trigger concurrent access to the parser from multiple threads
3. Exploit the resulting use-after-free to corrupt memory structures
4. Execute arbitrary code or force a crash

How to detect it

Inspect application crash logs and memory dumps for indicators of use-after-free during URL parsing operations involving non-UTF-8 data; correlate with network traffic containing unusual character encodings.

What your security team should do

• Apply the listed version upgrades across all deployments immediately
• Enable automatic update mechanisms where available
• Review crash reporting telemetry for related use-after-free signatures