CVE-2023-5169

What it actually does

A compromised content process can supply malicious data to a PathRecording object, triggering an out-of-bounds write that crashes a privileged process.

Why it matters to the business

Attackers who already have a foothold in the browser sandbox can escalate privileges, potentially leading to full browser compromise, data theft, or further system access on affected endpoints running unpatched versions.

How an attack unfolds

An attacker first compromises the lower-privileged content process (for example via a separate renderer bug), then crafts malicious PathRecording data that is passed across the IPC boundary, resulting in an out-of-bounds write inside the privileged parent process and a potentially exploitable crash.

How to fix it

Upgrade Mozilla Firefox to version 118 or later, Firefox ESR to 115.3 or later, and Thunderbird to 115.3 or later. Apply vendor patches as soon as they become available for any downstream distributions.

How to confirm the fix worked

Confirm the installed browser and mail client versions meet or exceed the fixed releases listed by Mozilla; re-test any custom builds or packaged distributions against the upstream fixed versions.

Typical attack path

1. Compromise the content/sandbox process via an initial vector
2. Craft and send malicious PathRecording data across the IPC boundary
3. Trigger the out-of-bounds write in the privileged parent process
4. Achieve code execution or crash for further exploitation

How to detect it

Look for unusual crashes in the parent or privileged browser processes that coincide with content-process activity; examine IPC logs and crash reports for PathRecording-related frames or malformed path data.

What your security team should do

• Prioritize patching Firefox, Firefox ESR, and Thunderbird instances to the fixed releases
• Monitor EPSS trend and any new exploit maturity signals even though current scores remain low
• Review sandbox and content-process isolation controls as compensating measures until patches are deployed