CVE-2023-25735

What it actually does

Use-after-free triggered when cross-compartment wrappers store objects from other compartments into the main compartment after unwrapping a scripted proxy, allowing dangling references to be dereferenced.

Why it matters to the business

Remote attackers can achieve arbitrary code execution on user systems running vulnerable browsers, enabling data theft, credential harvesting, or deployment of malware across an organization.

How an attack unfolds

An attacker hosts a malicious webpage that abuses scripted proxies and cross-compartment wrappers to force objects into the wrong compartment; upon unwrapping, the resulting use-after-free is leveraged through heap grooming to achieve code execution in the browser process.

How to fix it

Upgrade Mozilla Firefox to version 110 or later, Firefox ESR to 102.8 or later, and Thunderbird to 102.8 or later. Apply vendor updates as soon as they become available and verify installed versions match or exceed these releases.

How to confirm the fix worked

Query installed browser versions via enterprise management tools or endpoint agents; confirm that no instances remain below the fixed releases listed in the advisory. Re-scan after patch deployment to ensure exposure is eliminated.

Typical attack path

1. Deliver malicious HTML/JS via a crafted webpage or email attachment
2. Trigger cross-compartment wrapper wrapping of a scripted proxy
3. Force storage of foreign-compartment objects in the main compartment
4. Unwrap the proxy to create a dangling reference
5. Perform heap manipulation to control freed memory and execute attacker code

How to detect it

Review browser process crash logs and memory dumps for signs of use-after-free patterns; correlate with web request logs showing visits to suspicious domains shortly before crashes. Look for unexpected child process spawns or script execution anomalies in browser telemetry.

What your security team should do

• Immediately deploy browser updates to all managed endpoints
• Block known malicious domains associated with browser exploitation campaigns
• Enable browser sandboxing and site isolation features where available
• Monitor endpoint telemetry for unexpected browser process crashes or memory anomalies