CVE-2024-10466

What it actually does

A remote server sending a specially crafted push message hangs the parent process, rendering the browser or client unresponsive.

Why it matters to the business

Users lose access to essential browser-based workflows, causing operational delays and potential loss of productivity across affected systems.

How an attack unfolds

An attacker crafts a malicious push message and delivers it from a controlled remote server to trigger a hang in the parent process of vulnerable clients.

How to fix it

Upgrade libapache2-mod-nss to version 1.0.12-2 or later on Ubuntu 16.04 LTS; apply equivalent fixes for Firefox, Firefox ESR, and Thunderbird as listed in vendor advisories.

How to confirm the fix worked

Confirm package versions meet or exceed the fixed releases and test that crafted push messages no longer cause process hangs.

Typical attack path

1. Identify a target running an affected browser or client
2. Prepare and host a specially crafted push message on an attacker-controlled server
3. Trigger delivery of the push message to the victim client
4. Observe the parent process hang resulting in unresponsiveness

How to detect it

Review browser process logs and crash reports for unexpected parent process hangs following receipt of push messages; no widespread exploitation indicators are currently associated with this issue.

What your security team should do

• Prioritize patching affected Mozilla products and the listed Ubuntu package within standard maintenance windows given low EPSS and absence from KEV
• Monitor for any increase in EPSS trend or new threat actor reports
• Review browser update policies to ensure timely deployment of future fixes