CVE-2024-4775

What it actually does

Missing iterator stop condition when processing WASM in the built-in profiler leads to invalid memory access and undefined behavior, but only when the profiler is active.

Why it matters to the business

Potential application instability or limited memory corruption when profiling WASM workloads; low likelihood of widespread impact given narrow trigger conditions and low exploit probability.

How an attack unfolds

An attacker with the ability to execute code locally supplies specially crafted WASM while the profiler is enabled, causing the missing stop condition to trigger out-of-bounds access during iteration.

How to fix it

Upgrade to a version that implements the correct iterator stop condition in the profiler (Firefox 126 or later). Disable the profiler when not required as a temporary mitigation.

How to confirm the fix worked

Confirm the installed version is 126 or newer; exercise the profiler against representative WASM workloads and verify absence of memory errors or crashes.

Typical attack path

1. Enable the built-in profiler
2. Load or execute attacker-controlled WASM code
3. Trigger the profiler's iteration logic over the WASM data
4. Exploit resulting invalid memory access for limited read/write or crash

How to detect it

Review application crash logs and memory error reports that coincide with profiler activation on WASM content; no public exploitation artifacts are known.

What your security team should do

• Apply the vendor update to close the iterator flaw
• Audit environments where the profiler is routinely enabled
• Monitor for any future profiler-related memory issues