CVE-2024-4764

What it actually does

Use-after-free in WebRTC audio input handling where multiple threads can claim a newly connected audio input, leading to memory corruption and potential arbitrary code execution.

Why it matters to the business

Remote attackers could compromise browsers, enabling theft of credentials, session hijacking, or further network access without user interaction beyond visiting a malicious site.

How an attack unfolds

An attacker serves a webpage that initiates concurrent WebRTC audio streams to trigger a race condition on audio input claim, freeing memory while still referenced to achieve code execution in the browser process.

How to fix it

Upgrade Firefox to version 126 or later to resolve the race condition in WebRTC audio handling.

How to confirm the fix worked

Confirm installed Firefox version is 126 or newer; exercise WebRTC audio features in a test environment to ensure no crashes occur on input connection.

Typical attack path

1. Host malicious webpage containing WebRTC audio input code
2. Lure user to load the page via phishing or compromised site
3. Trigger multiple threads to simultaneously claim the audio input
4. Exploit resulting use-after-free for memory corruption and code execution

How to detect it

Review browser crash logs and process dumps for WebRTC audio thread anomalies; inspect network traffic for unexpected WebRTC media streams from untrusted origins.

What your security team should do

• Immediately deploy Firefox 126+ across all endpoints
• Block or sandbox WebRTC where not required via enterprise policy
• Monitor browser crash reports for WebRTC-related use-after-free signatures