CVE-2024-8384

What it actually does

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes, leading to memory corruption.

Why it matters to the business

Attackers could achieve remote code execution or denial of service in affected browser and mail clients, risking data theft or system takeover; the flaw appears in widely used Mozilla products with downstream dependents amplifying exposure across ecosystems.

How an attack unfolds

An attacker serves malicious JavaScript that triggers out-of-memory conditions at a precise timing between garbage collection passes, causing mis-coloring of cross-compartment objects; this leads to memory corruption that can be leveraged for arbitrary code execution, as seen in 2024 zero-day campaigns by espionage and financially motivated actors targeting the Mozilla Firefox use-after-free vulnerability.

How to fix it

Upgrade Firefox to version 130 or later, Firefox ESR to 128.2 or later (or 115.15 or later), and Thunderbird to 128.2 or later (or 115.15 or later); for the listed Gitea package, upgrade to 1.16.4.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed; test by attempting to reproduce OOM-induced mis-coloring scenarios in isolated environments and verify absence of memory corruption indicators.

Typical attack path

1. Deliver malicious JavaScript via web page or email attachment to a vulnerable Firefox or Thunderbird instance
2. Trigger specific OOM timing to induce garbage collector mis-coloring
3. Exploit resulting memory corruption to achieve code execution or crash

How to detect it

Review browser process crash logs and JavaScript execution traces for OOM-related anomalies around the time of suspected exploitation; correlate with known threat actor TTPs from 2024 campaigns targeting this class of memory issue.

What your security team should do

• Prioritize patching all Mozilla Firefox and Thunderbird instances immediately due to high CVSS and observed exploitation by threat actors
• Monitor EPSS and threat intelligence feeds for any rise in exploitation activity
• Apply the Gitea 1.16.4 update where that package is in use