CVE-2023-6862

What it actually does

Use-after-free condition in nsDNSService::Init that can be triggered during browser startup, potentially allowing memory corruption.

Why it matters to the business

Attackers could gain remote code execution on affected systems, leading to data theft, malware installation, or full device compromise, especially for organizations relying on older Firefox ESR or Thunderbird deployments.

How an attack unfolds

An attacker crafts a malicious webpage or email that triggers the rare startup race condition in DNS initialization; successful exploitation corrupts memory and executes arbitrary code with the privileges of the browser process.

How to fix it

Upgrade Firefox ESR to version 115.6 or later and Thunderbird to version 115.6 or later. Apply all vendor-supplied updates promptly; no other mitigations are known to fully address the flaw.

How to confirm the fix worked

Confirm installed versions are at least 115.6 for both products; re-test startup behavior under load to verify the race condition no longer manifests; monitor vendor advisories for backports.

Typical attack path

1. Victim launches Firefox ESR or Thunderbird
2. Attacker-controlled content is loaded during the narrow startup window
3. Use-after-free is triggered in nsDNSService::Init
4. Memory corruption leads to control-flow hijacking
5. Arbitrary code executes in the browser context

How to detect it

Review browser process crash logs and memory dumps around startup timestamps for signs of use-after-free; correlate with web requests or email attachments immediately preceding the crash.

What your security team should do

• Prioritize patching all Firefox ESR and Thunderbird instances to 115.6 within the next 48 hours
• Inventory endpoints running versions prior to 115.6 and isolate high-risk users
• Enable application allow-listing or sandboxing where feasible until patches are deployed
• Update detection rules to watch for anomalous browser process behavior during startup