CVE-2023-29548

What it actually does

Incorrect lowering in the ARM64 Ion JIT compiler produces wrong optimization results, resulting in memory corruption that can alter program state or data integrity during execution of JIT-compiled code.

Why it matters to the business

Attackers can tamper with browser or email client behavior on ARM64 systems, potentially leading to unauthorized data changes or integrity violations that disrupt operations or enable further compromise without requiring user credentials.

How an attack unfolds

An attacker crafts a malicious webpage or email attachment containing JavaScript or content that triggers the flawed ARM64 Ion optimization path; when the victim visits or opens it on an affected ARM64 device, the JIT compiler emits incorrect code allowing integrity manipulation.

How to fix it

Upgrade Firefox to version 112 or later, Firefox ESR to 102.10 or later, Focus for Android to 112 or later, Firefox for Android to 112 or later, and Thunderbird to 102.10 or later.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases and test that JIT-compiled ARM64 workloads no longer exhibit the optimization error through targeted regression tests or browser self-checks.

Typical attack path

1. Identify or craft content that exercises the faulty ARM64 Ion lowering path
2. Host the content on a web server or deliver via email
3. Trick the target into loading the content in an affected browser or Thunderbird on ARM64
4. Trigger JIT compilation to execute the misoptimized code
5. Leverage the resulting integrity violation to alter application state or data

How to detect it

Review web server or email logs for access to suspicious content that matches known trigger patterns; examine browser process crashes or anomalous JIT behavior on ARM64 systems for signs of integrity tampering.

What your security team should do

• Prioritize updating all ARM64 instances of Firefox, ESR, Focus, and Thunderbird to the fixed versions immediately
• Monitor vendor advisories for any additional ARM64 JIT-related issues
• Enforce automatic updates where possible and audit endpoints for outdated deployments