CVE-2024-0741

What it actually does

Out-of-bounds write in ANGLE library allows memory corruption that can trigger an exploitable crash.

Why it matters to the business

Affected browsers and email clients may crash when processing malicious content, leading to denial of service for users and potential loss of productivity until patches are applied.

How an attack unfolds

An attacker crafts specially formatted web or email content that, when processed by the vulnerable ANGLE component during rendering, triggers the out-of-bounds write resulting in a crash.

How to fix it

Upgrade Mozilla Firefox to version 122 or later, Firefox ESR to 115.7 or later, and Thunderbird to 115.7 or later. Apply updates through the application's built-in updater or package manager on Debian systems.

How to confirm the fix worked

Verify installed product versions match or exceed the fixed releases listed in the remediation guidance and confirm absence of the vulnerable ANGLE code paths via binary analysis or vendor advisories.

Typical attack path

1. Attacker prepares malicious webpage or email containing crafted graphics content
2. Victim opens the content in an affected Firefox, ESR, or Thunderbird version
3. ANGLE processes the content and performs the out-of-bounds write
4. Memory corruption occurs leading to application crash

How to detect it

Review application crash logs and telemetry for unexpected terminations in Firefox, ESR, or Thunderbird shortly after rendering web or email content; correlate with access to untrusted external resources.

What your security team should do

• Prioritize deployment of updates to all affected Mozilla products across the environment
• Monitor for application crashes in browser and email clients as potential indicators of attempted exploitation
• Review and enforce automatic update policies for Firefox, ESR, and Thunderbird