CVE-2023-3600

What it actually does

A use-after-free condition during the worker lifecycle can result in a crash that is potentially exploitable for arbitrary code execution.

Why it matters to the business

Remote attackers could gain control of affected systems or disrupt operations through crashes in widely used browsers and email clients, increasing risk of data compromise even though the flaw is over three years old with low observed exploitation rates.

How an attack unfolds

An attacker crafts malicious web content or email that triggers worker lifecycle events to dereference freed memory, enabling code execution or a denial-of-service crash.

How to fix it

Upgrade Firefox to 115.0.2 or later, Firefox ESR to 115.0.2 or later, and Thunderbird to 115.0.1 or later.

How to confirm the fix worked

Confirm installed product versions meet or exceed the fixed releases listed above and review crash reports for worker-related use-after-free signatures.

Typical attack path

1. Serve malicious web page or email attachment to target
2. Trigger worker creation or termination sequences
3. Trigger use-after-free to corrupt memory or execute payload
4. Achieve code execution or crash the application

How to detect it

Inspect browser and system crash logs for worker lifecycle faults; correlate with network requests that deliver unexpected JavaScript or email content.

What your security team should do

• Apply the listed updates immediately across all endpoints
• Enable automatic updates for Mozilla products where possible
• Review browser crash telemetry for worker lifecycle anomalies