CVE-2023-4577

What it actually does

A use-after-free condition occurs when UpdateRegExpStatics accesses initialStringHeap after it has been garbage collected, potentially causing an exploitable crash.

Why it matters to the business

Browser and email client crashes disrupt user productivity and can be leveraged for denial of service or remote code execution, increasing risk across the large installed base of Mozilla products.

How an attack unfolds

An attacker hosts a malicious webpage containing crafted JavaScript that forces garbage collection of initialStringHeap immediately before UpdateRegExpStatics attempts to reference it, turning the freed memory access into a crash or potential code-execution primitive.

How to fix it

Upgrade Firefox to 117 or later, Firefox ESR to 115.2 or later, and Thunderbird to 115.2 or later; enable automatic updates and verify versions across all endpoints.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases; re-test affected RegExp operations under memory-pressure conditions to ensure no crashes occur.

Typical attack path

1. Deliver malicious webpage via phishing or compromised site
2. Trigger JavaScript execution that manipulates RegExp statics
3. Force garbage collection of initialStringHeap
4. Invoke UpdateRegExpStatics on the now-freed heap object
5. Achieve crash or memory corruption for further exploitation

How to detect it

Review browser crash logs and heap-dump telemetry for faults involving RegExp statics or initialStringHeap references; correlate with web-request logs from untrusted domains.

What your security team should do

• Immediately deploy the listed version upgrades enterprise-wide
• Disable automatic script execution in high-risk browsers where feasible until patched
• Monitor crash-reporting telemetry for RegExp-related heap faults