CVE-2024-6602

What it actually does

Mismatch between allocator and deallocator routines leads to memory corruption in the browser and email client processes.

Why it matters to the business

Remote attackers could achieve arbitrary code execution on user systems running affected browser or email software, resulting in potential data theft, ransomware deployment, or full host compromise across an organization's endpoints.

How an attack unfolds

An attacker crafts web content or email attachments that trigger the allocator/deallocator mismatch during memory operations; successful corruption allows control-flow hijacking to execute attacker-supplied code without user interaction beyond visiting a site or opening a message.

How to fix it

Upgrade Firefox to version 128 or later, Firefox ESR to 115.13 or later, and Thunderbird to 115.13 or later; apply updates through the product's built-in updater or package manager as soon as available.

How to confirm the fix worked

Query installed application version strings and confirm they meet or exceed the fixed release thresholds; retest affected code paths with memory-safety tools if source builds are maintained.

Typical attack path

1. Identify vulnerable Firefox or Thunderbird instance via reconnaissance
2. Deliver malicious HTML, JavaScript, or email content to the target
3. Trigger specific allocation/deallocation sequence to induce heap corruption
4. Leverage corrupted memory to bypass ASLR or DEP and execute payload

How to detect it

Inspect browser and email client crash logs for heap-related faults, monitor process memory usage anomalies, and review web proxy or mail server logs for repeated requests to the same external domains from multiple hosts.

What your security team should do

• Prioritize immediate deployment of updates to all Firefox and Thunderbird instances
• Enable automatic updates where policy permits
• Review endpoint telemetry for unexpected crashes or memory-related errors in the interim