CVE-2024-3860

What it actually does

An out-of-memory condition during object initialization produces an empty shape list; subsequent JIT tracing of the object triggers a crash.

Why it matters to the business

Users visiting attacker-controlled web content may experience browser crashes that interrupt work and require restarts; the issue has shown no signs of active exploitation in the wild and carries low urgency for most environments.

How an attack unfolds

An attacker hosts a web page containing JavaScript that forces an out-of-memory state at the precise moment an object is initialized, leaving an empty shape list that later causes the JIT to dereference invalid data and crash the browser process.

How to fix it

Upgrade all Firefox installations to version 125 or later; apply the update through the browser's built-in updater or enterprise deployment channels.

How to confirm the fix worked

Confirm installed Firefox versions are 125 or newer; optionally reproduce the crash condition in a test environment with a crafted JavaScript payload before and after the update.

Typical attack path

1. Host a malicious web page served to targeted users
2. Execute JavaScript that triggers an out-of-memory condition during object initialization
3. Allow the JIT to trace the resulting malformed object and induce a crash

How to detect it

Review browser crash logs and user reports for sudden JIT-related terminations immediately after visiting unfamiliar sites; correlate with web proxy logs showing access to suspicious domains.

What your security team should do

• Deploy Firefox 125+ to all managed endpoints within standard patch windows
• Monitor crash reports for recurring JIT-related browser failures
• Block or sandbox access to untrusted web content where feasible