CVE-2022-45409

What it actually does

Aborted garbage collection in multiple states/zones prevented GCRuntime::finishCollection from running, resulting in a use-after-free condition that can lead to an exploitable crash.

Why it matters to the business

Attackers could achieve remote code execution or cause denial of service in affected browser and email clients, risking data theft, system compromise, and operational disruption.

How an attack unfolds

An attacker crafts malicious content that triggers specific garbage-collection states during page or message processing; the missing finishCollection call leaves dangling references that are later dereferenced to corrupt memory and execute arbitrary code.

How to fix it

Upgrade Firefox to 107 or later, Firefox ESR to 102.5 or later, and Thunderbird to 102.5 or later. Apply the corresponding fixed commits in any downstream TensorFlow builds that embed the affected runtime.

How to confirm the fix worked

Confirm the installed version meets or exceeds the fixed releases; inspect process memory or crash reports for absence of the described collection-abort patterns after applying updates.

Typical attack path

1. Deliver malicious webpage or email to victim
2. Trigger garbage collection at precise timing to abort collection
3. Force use-after-free dereference during subsequent script or layout operations
4. Achieve memory corruption and execute shellcode or ROP chain

How to detect it

Review browser crash logs for collection-abort signatures, monitor for unexpected process terminations after rendering untrusted content, and correlate with network requests to suspicious domains around the time of the crash.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances within the next 48 hours due to high CVSS and remote attack vector
• Block untrusted web content and email attachments until patches are deployed
• Enable browser sandboxing and content isolation features as temporary defense-in-depth