CVE-2022-45406

What it actually does

Out-of-memory during JavaScript global creation can delete a realm while BaseShape still holds references, resulting in use-after-free that may be leveraged for a crash or arbitrary code execution.

Why it matters to the business

Remote attackers could crash affected applications or achieve code execution on user systems, risking data exposure and operational disruption; the issue has been public for years with no observed exploitation or ransomware use.

How an attack unfolds

An attacker supplies crafted web content that triggers an out-of-memory condition exactly when a JavaScript global is allocated, leaving dangling references that are later dereferenced to corrupt memory or redirect execution.

How to fix it

Upgrade to Firefox ESR 102.5 or later, Thunderbird 102.5 or later, or Firefox 107 or later. For tensorflow/tensorflow (GIT) apply commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0.

How to confirm the fix worked

Confirm the installed browser or tensorflow build reports the fixed version string; attempt reproduction of the OOM sequence in a controlled test environment and verify no crash occurs.

Typical attack path

1. Deliver malicious JavaScript via a web page or email attachment
2. Trigger allocation failure during global creation
3. Force realm deletion while BaseShape references persist
4. Reuse freed memory to corrupt control structures
5. Achieve crash or code execution

How to detect it

Review browser crash reports and memory dumps for patterns involving BaseShape and realm deletion; correlate with web-request logs showing unusual JavaScript execution immediately before the crash.

What your security team should do

• Prioritize patching browsers and Thunderbird within standard maintenance windows
• Monitor EPSS and KEV feeds for any future change in exploitability
• Apply the tensorflow commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0 if that package is in use