CVE-2024-5695

What it actually does

An out-of-memory condition during allocations in the probabilistic heap checker can trigger an assertion failure or, in rarer cases, result in memory corruption within the browser process.

Why it matters to the business

Outdated browser deployments face elevated risk of instability or compromise that could disrupt user workflows and expose systems to unauthorized access, though public exploitation remains unlikely given low observed activity.

How an attack unfolds

An attacker crafts web content designed to induce a precise out-of-memory state at the heap checker allocation point, attempting to leverage the resulting corruption for arbitrary code execution within the Firefox process.

How to fix it

Upgrade all Firefox installations to version 127 or later to resolve the allocation handling flaw.

How to confirm the fix worked

Verify installed Firefox version is 127 or higher via the about:support page or enterprise inventory tools.

Typical attack path

1. Serve malicious web content to a vulnerable Firefox instance
2. Trigger an out-of-memory condition at the specific heap checker allocation site
3. Attempt to leverage resulting memory corruption for code execution

How to detect it

Examine browser crash reports and memory dumps for signs of heap checker assertion failures or unexpected corruption under high-memory conditions; no widespread exploitation artifacts have been observed.

What your security team should do

• Prioritize updating Firefox deployments to 127 or newer across the environment
• Enable automatic updates where possible to reduce future exposure windows
• Review browser usage policies to limit reliance on unsupported versions