CVE-2024-8385

What it actually does

Difference in handling of StructFields versus ArrayTypes within WASM triggers type confusion that corrupts memory state and enables arbitrary code execution.

Why it matters to the business

Successful exploitation on widely deployed browsers can result in full system compromise, credential theft, or lateral movement; high ecosystem prevalence amplifies organizational exposure even though the issue is not currently tracked in KEV.

How an attack unfolds

An attacker crafts a malicious WASM module that exercises the StructFields/ArrayTypes discrepancy; when the victim browser processes the module, type confusion occurs, memory is corrupted, and control flow is hijacked to run attacker-supplied code. The technique has appeared in 2024 zero-day campaigns conducted by espionage and financially motivated actors.

How to fix it

Update Firefox to 130 or newer, Firefox ESR to 128.2 or newer, and Thunderbird to 128.2 or newer; organizations using github.com/theupdateframework/go-tuf must upgrade to version 0.3.0.

How to confirm the fix worked

Verify installed product versions against the fixed releases above and confirm that WASM modules containing mixed StructFields and ArrayTypes no longer cause type-confusion crashes.

Typical attack path

1. Host a malicious webpage containing a crafted WASM payload
2. Victim browser loads and validates the WASM module
3. StructFields/ArrayTypes mismatch triggers type confusion
4. Memory corruption is leveraged for code execution
5. Attacker payload establishes persistence or exfiltrates data

How to detect it

Review browser process crash logs and WASM validation failures for indicators of type confusion; correlate with known 2024 zero-day campaign patterns and monitor network traffic for unexpected WASM downloads from untrusted domains.

What your security team should do

• Apply the listed browser and go-tuf updates within 48 hours
• Block untrusted WASM execution via content-security policy where feasible
• Hunt for exploitation artifacts using the supplied detection guidance
• Track EPSS and threat-actor reporting for any future rise in activity