CVE-2022-45407

What it actually does

Use-after-free triggered when a font is loaded via FontFace() on a background worker thread, resulting in a crash that may be exploitable for arbitrary code execution.

Why it matters to the business

Potential browser crashes or remote code execution on end-user systems running outdated versions, leading to service disruption and possible compromise of user workstations across the organization.

How an attack unfolds

An attacker crafts a web page or script that invokes FontFace() from a web worker to trigger the use-after-free condition in the font handling code of affected Firefox versions.

How to fix it

Upgrade all instances of Mozilla Firefox to version 107 or later. Enforce automatic updates where possible and remove or isolate unsupported older versions.

How to confirm the fix worked

Verify installed Firefox versions are 107 or newer via enterprise management tools or about:support; re-test any internal web applications that load fonts in workers after the update.

Typical attack path

1. Host a malicious web page containing FontFace() calls executed inside a background worker
2. Lure a victim running an affected Firefox version to visit the page
3. Trigger the use-after-free through concurrent font operations to cause a crash or gain code execution

How to detect it

Review browser crash reports and telemetry for unexpected terminations when loading web content that uses font APIs in workers; correlate with web server logs showing access to pages known to trigger FontFace in workers.

What your security team should do

• Immediately deploy Firefox 107+ across all managed endpoints
• Monitor for any remaining instances of Firefox versions below 107
• Review web application code that uses FontFace() inside workers for safe patterns