CVE-2024-10459: Mozilla Firefox Use-After-Free Vulnerability

CVE-2024-10459 Overview

CVE-2024-10459 is a use-after-free vulnerability [CWE-416] affecting Mozilla Firefox and Thunderbird when accessibility features are enabled. Mozilla disclosed the issue in security advisories mfsa2024-55 through mfsa2024-59. An attacker who can trigger the affected code path may cause a potentially exploitable crash through memory corruption in the browser process.

The vulnerability impacts Firefox versions before 132, Firefox ESR before 128.4, Firefox ESR before 115.17, and Thunderbird versions before 128.4 and 132. The flaw is network-accessible and requires no privileges or user interaction beyond standard browsing activity with accessibility enabled.

Critical Impact
Successful exploitation can crash the browser or email client and may lead to arbitrary code execution within the application's process context.

Affected Products

Mozilla Firefox versions prior to 132
Mozilla Firefox ESR versions prior to 128.4 and 115.17
Mozilla Thunderbird versions prior to 128.4 and 132

Discovery Timeline

2024-10-29 - CVE-2024-10459 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-10459

Vulnerability Analysis

The vulnerability is a use-after-free condition that surfaces when the accessibility subsystem is active in Firefox or Thunderbird. Accessibility services expose internal application objects to assistive technologies and require careful lifetime management of those objects. When a referenced object is freed but a dangling pointer remains reachable, subsequent dereferences operate on reclaimed memory.

Attackers can craft web content or HTML email content that triggers the affected accessibility code path. Because the dangling pointer may reference attacker-influenced data, the resulting crash is described by Mozilla as potentially exploitable for code execution rather than a simple denial of service.

Thunderbird is affected because it shares the Gecko rendering engine with Firefox. HTML message rendering and remote content fetching can reach the vulnerable code, even though scripting is restricted in the mail context.

Root Cause

The root cause is improper object lifetime tracking inside the accessibility tree. An object is released while another component continues to hold a reference, violating the invariant that all references are dropped before deallocation. The defect is classified as [CWE-416] Use After Free. Refer to the Mozilla Bugzilla Report for the upstream tracking entry.

Attack Vector

Exploitation requires the victim to load attacker-controlled content in a vulnerable build with accessibility enabled. The attacker hosts a malicious page or sends an HTML email that drives the accessibility code into the freed-object state. No authentication is required, and no specific user gesture beyond rendering the content is needed. See Mozilla Security Advisory #2024-55 for vendor detail.

Detection Methods for CVE-2024-10459

Indicators of Compromise

Unexpected Firefox or Thunderbird process crashes generating minidump files in the user profile Crash Reports directory.
Crash signatures referencing accessibility modules such as mozilla::a11y:: frames in stack traces.
Outbound connections from browser processes to newly observed domains immediately preceding a crash.

Detection Strategies

Inventory installed Firefox and Thunderbird versions across endpoints and flag builds below Firefox 132, ESR 128.4, ESR 115.17, or Thunderbird 128.4.
Correlate crash telemetry with web proxy logs to identify pages associated with browser termination events.
Monitor for child process spawning from firefox.exe or thunderbird.exe that deviates from baseline behavior, which can indicate post-exploitation activity.

Monitoring Recommendations

Forward endpoint crash events and browser telemetry to a centralized analytics platform for cross-host correlation.
Alert on browser processes loading unsigned modules or performing memory operations consistent with exploitation primitives.
Track patch compliance for Mozilla products on a recurring schedule and report drift to security operations.

How to Mitigate CVE-2024-10459

Immediate Actions Required

Upgrade Firefox to version 132 or later, Firefox ESR to 128.4 or 115.17, and Thunderbird to 128.4 or 132.
Identify any managed endpoints running unsupported Firefox or Thunderbird builds and prioritize them for remediation.
Restrict execution of outdated browser versions through application allowlisting where update windows are constrained.

Patch Information

Mozilla released fixes in Firefox 132, Firefox ESR 128.4, Firefox ESR 115.17, Thunderbird 128.4, and Thunderbird 132. Distribution packages are tracked in Debian LTS Announcement #34 and Debian LTS Announcement #1. Vendor advisories are listed under Mozilla Security Advisory #2024-55 through Mozilla Security Advisory #2024-59.

Workarounds

Disable accessibility services in Firefox and Thunderbird until patching is complete, recognizing the impact on assistive technology users.
Block HTML email rendering of remote content in Thunderbird to reduce exposure from inbound messages.
Apply enterprise policies that enforce automatic updates for Mozilla products on managed endpoints.

bash

# Configuration example: enforce Firefox auto-update via policies.json
# Place this file at /etc/firefox/policies/policies.json (Linux) or
# %ProgramFiles%\Mozilla Firefox\distribution\policies.json (Windows)
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true,
    "DisableAccessibilityServices": true
  }
}