CVE-2023-25739

What it actually does

Failed module load requests that are cancelled are not validated before reuse, resulting in a use-after-free condition within ScriptLoadContext that can be leveraged for memory corruption.

Why it matters to the business

Attackers could gain control of a user's browser or email client on unpatched systems, enabling data theft, credential capture, or further network compromise; the issue is years old with no known exploitation campaigns, reducing immediate operational urgency.

How an attack unfolds

An attacker serves a specially crafted web page or email that triggers a module load failure followed by cancellation; the dangling reference in ScriptLoadContext is then accessed, corrupting memory to achieve code execution in the browser process.

How to fix it

Upgrade Mozilla Firefox to version 110 or later, Firefox ESR to 102.8 or later, and Thunderbird to 102.8 or later. Apply updates through the application's built-in updater or package manager as soon as possible.

How to confirm the fix worked

Verify installed versions meet or exceed Firefox 110, ESR 102.8, and Thunderbird 102.8; confirm absence of ScriptLoadContext use-after-free crashes in diagnostic logs after update.

Typical attack path

1. Deliver malicious content via web page or email attachment
2. Trigger failed and cancelled module load in ScriptLoadContext
3. Reuse freed object to corrupt memory
4. Execute arbitrary code within the browser or Thunderbird process

How to detect it

Review browser and Thunderbird crash reports for ScriptLoadContext references; examine web server logs for unusual module load patterns from external sources; no confirmed in-the-wild exploitation artifacts are known.

What your security team should do

• Prioritize patching all Firefox, ESR, and Thunderbird instances to the fixed releases
• Monitor for any future EPSS increases or KEV listings despite current low exploit maturity
• Disable unnecessary JavaScript module loading where feasible until patches are deployed