CVE-2023-23597

What it actually does

A compromised web child process can bypass web security opening restrictions to spawn a new child process in the file:// context, enabling subsequent arbitrary file read when combined with another exploit primitive.

Why it matters to the business

Attackers who already have a foothold in a browser process could read arbitrary local files belonging to the user, exposing credentials, documents, or other sensitive data on systems running outdated Firefox versions.

How an attack unfolds

An attacker first obtains code execution inside a web renderer child process through a separate vulnerability, then leverages this flaw to disable security restrictions, spawn a new process under the file:// origin, and chain a second primitive to read arbitrary files from the local filesystem.

How to fix it

Upgrade Mozilla Firefox to version 109 or later on all affected systems; ensure automatic updates are enabled and verify the installed version after deployment.

How to confirm the fix worked

Confirm the Firefox version string is 109.0 or higher; re-test any known renderer escape primitives to ensure file:// process spawning is no longer possible.

Typical attack path

1. Obtain initial code execution inside a Firefox web renderer child process
2. Disable web security opening restrictions via the flaw
3. Spawn a new child process within the file:// context
4. Chain a second exploit primitive to perform arbitrary file reads

How to detect it

Inspect process creation logs and browser telemetry for Firefox child processes launched with file:// origins or unusual sandbox bypass indicators; correlate with known renderer compromise events.

What your security team should do

• Prioritize immediate upgrade of all Firefox installations to 109 or newer
• Disable automatic opening of untrusted file:// URIs via enterprise policy where feasible
• Monitor browser update compliance dashboards for the next 30 days
• Review endpoint detection rules for suspicious Firefox child processes