CVE-2023-37202

What it actually does

Cross-compartment wrapper mishandling of scripted proxies allows objects from other compartments to be stored in the main compartment, resulting in a use-after-free condition that can lead to arbitrary code execution.

Why it matters to the business

Attackers could execute code, steal data, or take control of user systems running vulnerable browser or email client versions, leading to data breaches, malware deployment, or loss of user trust; widespread deployment of affected Mozilla products increases organizational exposure.

How an attack unfolds

An attacker crafts a malicious webpage or email containing JavaScript that triggers cross-compartment wrapper behavior with scripted proxies; when the victim visits or opens the content, the use-after-free is triggered allowing memory corruption and subsequent code execution within the browser process.

How to fix it

Upgrade Firefox to version 115 or later, Firefox ESR to 102.13 or later, and Thunderbird to 102.13 or later. Apply vendor patches immediately; where upgrades are delayed, enforce strict content restrictions and browser isolation policies.

How to confirm the fix worked

Verify installed product versions against the fixed releases (Firefox >=115, ESR >=102.13, Thunderbird >=102.13); retest affected functionality with crafted test cases that exercise cross-compartment proxy wrappers; confirm absence of vulnerable binaries via package managers or software inventory.

Typical attack path

1. Deliver malicious content via web page or email to a victim using an affected browser or Thunderbird client
2. Trigger cross-compartment wrapper logic involving a scripted proxy
3. Cause objects from other compartments to be stored in the main compartment
4. Trigger the use-after-free through subsequent object access
5. Exploit the resulting memory corruption for arbitrary code execution

How to detect it

Review browser and Thunderbird process crash reports, memory dumps, and audit logs for signs of unexpected compartment transitions or proxy wrapper activity; correlate with access to suspicious external content around the time of any anomalous behavior.

What your security team should do

• Prioritize immediate upgrade of all Firefox, ESR, and Thunderbird instances to the fixed versions
• Monitor for any post-patch indicators of prior exploitation in browser crash logs or memory dumps
• Restrict execution of untrusted JavaScript and email rendering until patches are applied
• Update vulnerability management tooling to flag any remaining instances older than the fixed releases