CVE-2023-37209

What it actually does

A use-after-free condition in NotifyOnHistoryReload leaves a dangling reference to a freed LoadingSessionHistoryEntry object that can be reused, resulting in memory corruption that may be turned into arbitrary code execution.

Why it matters to the business

Users on unpatched Firefox versions face the risk of remote code execution simply by visiting a malicious site, which can lead to credential theft, ransomware deployment, or full system compromise across an organization.

How an attack unfolds

An attacker serves a crafted webpage that manipulates browser history navigation and reload sequences; when the freed object reference is later dereferenced, the attacker supplies controlled data to achieve code execution within the browser process.

How to fix it

Upgrade all instances of Firefox to version 115 or later; apply the fix as soon as possible given the high-severity memory corruption nature of the flaw.

How to confirm the fix worked

Verify installed Firefox version is 115 or higher; re-test affected history navigation paths under memory sanitizers or observe absence of crashes on crafted test pages.

Typical attack path

1. Attacker hosts a malicious webpage designed to trigger history reload operations
2. Victim browser visits the page and the use-after-free is triggered
3. Attacker reuses the dangling reference to corrupt memory and gain code execution
4. Malicious payload executes in the context of the browser process

How to detect it

Review browser crash logs and memory sanitizer reports for symptoms consistent with use-after-free during history reload operations; correlate with web request logs to malicious domains.

What your security team should do

• Immediately deploy Firefox 115+ across the fleet
• Block or isolate browsers that cannot be updated promptly
• Monitor browser crash reports and memory-corruption indicators for signs of exploitation attempts