CVE-2024-0754: Mozilla Firefox DOS Vulnerability

CVE-2024-0754 Overview

CVE-2024-0754 is a denial-of-service vulnerability in Mozilla Firefox affecting versions prior to 122. Specially crafted WebAssembly (WASM) source files can trigger a crash when loaded in the browser's Developer Tools. The flaw is categorized under [CWE-248] (Uncaught Exception) and can be reached remotely if a user opens devtools on a page hosting a malicious WASM module. Exploitation impacts availability only; there is no confirmed effect on confidentiality or integrity. Mozilla addressed the issue in Firefox 122 as part of security advisory MFSA-2024-01.

Critical Impact
Attackers can crash the Firefox browser process by serving malicious WebAssembly source files to users inspecting them in devtools.

Affected Products

Mozilla Firefox versions prior to 122
Firefox builds bundling the affected devtools WASM source viewer
Downstream distributions shipping Firefox < 122

Discovery Timeline

2024-01-23 - CVE-2024-0754 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0754

Vulnerability Analysis

The vulnerability resides in the Firefox devtools component responsible for parsing and displaying WebAssembly source files. When a user opens the debugger view on a page that loads a malformed WASM module, the source viewer fails to handle certain inputs cleanly. This results in an uncaught exception that terminates the affected process. The classification under [CWE-248] indicates that error paths in the WASM source loader do not gracefully recover from unexpected input structures. Because exploitation requires the user to interact with devtools, the attack surface is narrower than a passive drive-by, but developer-focused targeting remains viable.

Root Cause

The root cause is improper exception handling within the devtools WASM source pipeline. Certain byte sequences in a WASM binary drive the parser into a state it cannot recover from, and the resulting exception propagates unhandled. Mozilla tracked the defect in Bugzilla #1871605.

Attack Vector

A remote attacker hosts a page containing a crafted WebAssembly module. When a victim visits the page and opens Firefox devtools to inspect the module in the debugger, the parser encounters the malformed input and crashes. User interaction is required, and no elevated privileges are needed. See the Mozilla Security Advisory MFSA-2024-01 for vendor guidance.

// No verified proof-of-concept is publicly available.
// Refer to Mozilla Bugzilla #1871605 for technical details.

Detection Methods for CVE-2024-0754

Indicators of Compromise

Unexpected Firefox process crashes on developer workstations shortly after opening devtools on external sites
Crash telemetry entries referencing the devtools WASM source viewer in Firefox versions below 122
Web traffic to untrusted domains serving .wasm resources followed by browser instability

Detection Strategies

Inventory endpoint browser versions to identify Firefox installations prior to 122
Correlate browser crash reports with recent navigation to pages hosting WebAssembly content
Review devtools usage patterns on developer endpoints to flag anomalous WASM inspection activity

Monitoring Recommendations

Collect Firefox crash reports and application logs into a centralized data lake for trend analysis
Monitor DNS and proxy logs for connections to newly observed domains delivering WASM payloads
Alert on repeated Firefox process terminations on the same endpoint within short intervals

How to Mitigate CVE-2024-0754

Immediate Actions Required

Update Firefox to version 122 or later on all managed endpoints
Prioritize patching developer workstations that routinely use devtools
Restrict access to untrusted sites hosting arbitrary WebAssembly content where feasible

Patch Information

Mozilla released the fix in Firefox 122. Administrators should apply the update referenced in Mozilla Security Advisory MFSA-2024-01. Enterprise deployments using Firefox ESR should track the corresponding ESR release notes for the backported fix.

Workarounds

Avoid opening the devtools debugger on untrusted pages that load WebAssembly modules
Use enterprise policy to enforce automatic Firefox updates across the fleet
Isolate browser sessions used for inspecting untrusted content within dedicated virtual machines or containers

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Example enterprise policy snippet to enforce automatic updates
# /etc/firefox/policies/policies.json
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true
  }
}