CVE-2023-4574

What it actually does

Use-after-free triggered when multiple identical IPC callbacks for the Color Picker window are created and then simultaneously destroyed upon completion of any one callback, resulting in a dangling reference and exploitable crash.

Why it matters to the business

Browser or email client crashes can interrupt user workflows and create denial-of-service conditions; because the flaw is reachable from web content it raises the risk of targeted disruption for organizations that rely on Firefox or Thunderbird.

How an attack unfolds

An attacker serves specially crafted web content or an email that causes the browser to open the color-picker dialog multiple times over IPC; the rapid creation and collective destruction of the callbacks leaves a freed object that is later accessed, producing a crash that may be turned into code execution.

How to fix it

Upgrade Firefox to 117 or later, Firefox ESR to 102.15 or 115.2 or later, and Thunderbird to 102.15 or 115.2 or later. Where immediate patching is not possible, restrict untrusted web content or email rendering in the affected applications.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed in the advisory; re-test the color-picker IPC path under controlled conditions to verify the crash no longer occurs.

Typical attack path

1. Deliver malicious HTML or email to a target user
2. Trigger repeated IPC calls to open the color-picker window
3. Force simultaneous destruction of the duplicate callbacks
4. Trigger subsequent use of the now-freed callback object
5. Crash the process and attempt to leverage the freed memory for arbitrary code execution

How to detect it

Monitor application crash logs and telemetry for repeated color-picker or IPC callback failures; correlate with browser process terminations shortly after rendering untrusted content.

What your security team should do

• Prioritize patching of internet-facing Firefox and Thunderbird deployments within the next 30 days
• Enable automatic updates for all Mozilla products across the fleet
• Review crash-reporting telemetry for sudden spikes in color-picker or IPC-related crashes
• Block or sandbox untrusted web content until patches are deployed