CVE-2023-4575

What it actually does

Use-after-free triggered when multiple IPC callbacks for the File Picker window are created and then simultaneously destroyed, allowing memory reuse after deallocation and resulting in a crash.

Why it matters to the business

Users of affected browser and email clients face potential denial-of-service crashes or, in the worst case, remote code execution that could lead to data theft or system compromise until patches are applied.

How an attack unfolds

An attacker supplies crafted content that causes the browser to open the File Picker via IPC, deliberately creating overlapping callbacks that are freed together; when one callback finishes and frees the shared memory, subsequent accesses in the remaining callbacks trigger the use-after-free condition.

How to fix it

Upgrade Firefox to version 117 or later, Firefox ESR to 102.15 or 115.2 or later, and Thunderbird to 102.15 or 115.2 or later. Apply updates through the product's built-in update mechanism as soon as they become available.

How to confirm the fix worked

Verify installed versions against the fixed releases listed above; re-test the File Picker IPC flow under load to confirm absence of overlapping callbacks and crashes.

Typical attack path

1. Deliver malicious web content or email that triggers the File Picker IPC path
2. Force repeated callback registration before any single callback completes
3. Trigger simultaneous destruction of the callback set to induce the use-after-free
4. Leverage the resulting memory corruption to achieve a crash or attempt code execution

How to detect it

Search browser and Thunderbird crash reports for signatures involving IPC File Picker callbacks; inspect process logs for repeated callback registration events followed immediately by access violations or heap corruption indicators.

What your security team should do

• Prioritize patching all Firefox and Thunderbird instances to the fixed versions within the next 48 hours
• Enable automatic updates where possible and monitor for any post-patch crash reports related to IPC callbacks
• Review endpoint detection logs for unexpected browser crashes during file-picker operations