CVE-2023-28162

What it actually does

A type confusion flaw in AudioWorklet handling allows casting an object reference to an invalid dynamic type, producing memory corruption that can be leveraged for arbitrary code execution or denial of service.

Why it matters to the business

Successful exploitation can let attackers run code on end-user systems via malicious web content, resulting in data theft, ransomware deployment, or loss of productivity across any organization whose workforce relies on the affected browsers.

How an attack unfolds

An attacker prepares a web page containing a malicious AudioWorklet that triggers the invalid type cast. When a victim loads the page in a vulnerable browser, the corruption occurs inside the content process and can be turned into code execution without further user interaction beyond visiting the page.

How to fix it

Upgrade Mozilla Firefox to 111 or newer, Firefox ESR to 102.9 or newer, and Thunderbird to 102.9 or newer. Apply updates through the product’s built-in updater or enterprise deployment channels as soon as they become available.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed above. Reproduce known-safe AudioWorklet usage patterns and ensure no crashes occur under normal operation.

Typical attack path

1. Attacker hosts a crafted web page that exercises AudioWorklet code paths
2. Victim is lured to the page through phishing or compromised sites
3. Browser parses and executes the malicious AudioWorklet
4. Type confusion produces memory corruption
5. Attacker achieves code execution or browser crash

How to detect it

Review browser crash reports and process logs for faults occurring inside AudioWorklet or media-related modules; correlate with web-request logs to suspicious domains around the time of any crash.

What your security team should do

• Immediately deploy the latest fixed browser versions to all managed endpoints
• Block known malicious domains that have been observed serving similar browser exploits
• Enable browser crash reporting and review logs for repeated AudioWorklet-related faults
• Communicate the urgency of updates to end users and require confirmation of upgrade