CVE-2024-11691 Overview
CVE-2024-11691 is an out-of-bounds write vulnerability affecting Mozilla Firefox and Thunderbird when running on Apple silicon M series hardware. The flaw resides in Apple's GPU driver and is triggered by specific WebGL operations performed by the browser. Successful exploitation can cause memory corruption, potentially leading to arbitrary code execution within the browser process. The vulnerability is platform-specific and does not affect Firefox or Thunderbird running on Intel-based Macs, Windows, or Linux systems. Mozilla addressed the issue in Firefox 133, Firefox ESR 128.5, Firefox ESR 115.18, and the corresponding Thunderbird releases. The weakness is classified under CWE-787 (Out-of-Bounds Write).
Critical Impact
A remote attacker can trigger memory corruption in Firefox or Thunderbird on Apple M1, M2, M3, and M4 devices by serving a crafted WebGL payload, with potential for arbitrary code execution.
Affected Products
- Mozilla Firefox versions prior to 133
- Mozilla Firefox ESR prior to 128.5 and prior to 115.18
- Mozilla Thunderbird versions prior to 133, 128.5, and 115.18 on Apple M1, M2, M3, and M4 series silicon
Discovery Timeline
- 2024-11-26 - CVE-2024-11691 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11691
Vulnerability Analysis
The vulnerability is an out-of-bounds write that occurs during WebGL rendering operations on Apple M series GPUs. WebGL exposes the underlying graphics driver to JavaScript executing in the browser, and Firefox routes these calls through Apple's GPU driver on macOS. Certain operation sequences trigger memory corruption inside the driver path used by the content process. Because the bug originates in the GPU driver, only Apple silicon devices are affected. Other macOS hardware platforms and operating systems remain unaffected by this specific defect.
Root Cause
The root cause is improper bounds enforcement in Apple's GPU driver when handling specific WebGL operations dispatched by Firefox. The driver writes data outside the bounds of an allocated buffer, corrupting adjacent memory. Mozilla mitigated the issue at the application level by adjusting how Firefox issues WebGL calls to the driver. Details are tracked in Mozilla Bug 1914707 and Mozilla Bug 1924184.
Attack Vector
Exploitation requires a user on an Apple silicon Mac to visit a webpage or open an HTML email containing crafted WebGL content. The attack is network-reachable and requires user interaction such as loading a page in Firefox or rendering a message in Thunderbird. No prior authentication is needed. Successful corruption of GPU-driver memory can be leveraged to escape WebGL state integrity and influence execution within the renderer process. Refer to the Mozilla Foundation Security Advisory MFSA-2024-63 for vendor analysis. No verified exploit code is publicly available for this issue.
Detection Methods for CVE-2024-11691
Indicators of Compromise
- Unexpected crashes of firefox or thunderbird processes on Apple M1, M2, M3, or M4 hardware accompanied by GPU driver fault signatures in Console.app or unified logs
- Crash reports referencing WebGL contexts, IOAccelerator, or Metal driver components on macOS endpoints
- Browser content processes spawning unexpected child processes shortly after rendering untrusted WebGL content
Detection Strategies
- Inventory all macOS endpoints running Apple silicon and query installed Firefox or Thunderbird versions against the fixed releases (133, ESR 128.5, ESR 115.18)
- Correlate browser crash telemetry with web proxy logs to identify users visiting pages immediately before a Firefox or Thunderbird fault
- Hunt for post-crash anomalies such as new persistence items in ~/Library/LaunchAgents or unexpected outbound connections from browser-spawned processes
Monitoring Recommendations
- Forward macOS unified logs, Firefox crash reports, and EDR telemetry into a centralized data lake for cross-source correlation
- Alert on repeated content-process crashes from the same user session, which can indicate exploitation attempts against memory corruption flaws
- Track patch compliance for Firefox and Thunderbird on Apple silicon fleets as a dedicated dashboard metric
How to Mitigate CVE-2024-11691
Immediate Actions Required
- Upgrade Firefox to version 133 or later, Firefox ESR to 128.5 or 115.18, and Thunderbird to 133, 128.5, or 115.18 on all Apple silicon Macs
- Validate patch deployment through software inventory tooling and reboot affected systems to ensure the updated binary is in use
- Prioritize remediation for developer, executive, and high-risk user populations that browse untrusted content on M series MacBooks
Patch Information
Mozilla shipped fixes in the November 2024 release cycle. Consult the advisories for the full version matrix: MFSA-2024-63, MFSA-2024-64, MFSA-2024-65, MFSA-2024-67, MFSA-2024-68, and MFSA-2024-70.
Workarounds
- Disable WebGL in Firefox by setting webgl.disabled to true in about:config until patches are deployed
- Restrict Thunderbird to plain text rendering for remote content to reduce attack surface from HTML email
- Use enterprise policy to enforce automatic Firefox and Thunderbird updates on macOS endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
