CVE-2023-5175

What it actually does

Use-after-free in ImageBitmap object handling during Firefox process shutdown allows a freed object to be accessed from a separate code path, resulting in memory corruption that can be leveraged for arbitrary code execution.

Why it matters to the business

Attackers could remotely compromise user systems running outdated Firefox versions, leading to data theft, malware deployment, or loss of browser session integrity; the vulnerability has existed for over three years with modest but rising exploit probability.

How an attack unfolds

An attacker crafts web content that forces creation of an ImageBitmap object, then triggers browser process shutdown while a parallel code path retains a reference to the soon-to-be-freed object, converting the resulting crash into code execution.

How to fix it

Upgrade all Firefox installations to version 118 or newer; enable automatic updates and verify the installed version via about:support or enterprise management tools.

How to confirm the fix worked

Confirm Firefox version is 118 or greater; monitor for absence of related crash reports containing ImageBitmap references in about:crashes after the update window.

Typical attack path

1. Deliver malicious webpage or extension content to a Firefox user
2. Trigger ImageBitmap allocation during normal page processing
3. Initiate or force browser process shutdown sequence
4. Reuse dangling pointer from the alternate code path to corrupt memory
5. Execute arbitrary code or achieve sandbox escape

How to detect it

Search browser crash reports and telemetry for ImageBitmap objects referenced after shutdown signals; review process termination logs around the time of unexpected Firefox exits.

What your security team should do

• Immediately deploy Firefox 118+ across all managed endpoints
• Prioritize user populations with high browser exposure or sensitive data access
• Review endpoint crash telemetry for ImageBitmap shutdown signatures in the interim