CVE-2024-3852: Mozilla Firefox Use-After-Free Vulnerability

CVE-2024-3852 Overview

CVE-2024-3852 is a high-severity vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird. The flaw resides in the SpiderMonkey JavaScript engine, where the GetBoundName function could return the wrong version of an object when Just-In-Time (JIT) compiler optimizations were applied. This type confusion condition affects Firefox versions prior to 125, Firefox ESR prior to 115.10, and Thunderbird prior to 115.10. The weakness is tracked as [CWE-386] (Symbolic Name not Mapping to Correct Object) and can be triggered by a victim visiting attacker-controlled web content.

Critical Impact
A remote attacker who convinces a user to load a crafted page can trigger JIT-related object confusion that may lead to memory corruption and potential code execution within the browser process.

Affected Products

Mozilla Firefox versions prior to 125
Mozilla Firefox ESR versions prior to 115.10
Mozilla Thunderbird versions prior to 115.10

Discovery Timeline

2024-04-16 - CVE-2024-3852 published to NVD
2025-04-01 - Last updated in NVD database

Technical Details for CVE-2024-3852

Vulnerability Analysis

The vulnerability exists in SpiderMonkey, the JavaScript engine that powers Firefox and Thunderbird. The GetBoundName helper resolves bound names during JavaScript execution. When the JIT compiler applied certain optimizations, GetBoundName could return a stale or incorrect version of an object. The mismatch between the object the engine reasoned about and the object actually returned creates a type confusion scenario. An attacker can leverage this discrepancy to read or write memory outside the expected boundaries of the original object.

Mozilla classifies the issue as high impact in advisories MFSA-2024-18, MFSA-2024-19, and MFSA-2024-20. The flaw is reachable from any web page rendered by an unpatched browser, and Thunderbird is affected because it embeds the same Gecko/SpiderMonkey rendering stack. Exploitation requires user interaction in the form of loading malicious content.

Root Cause

The root cause is incorrect object versioning in JIT-optimized code paths. The JIT inlined or cached assumptions about an object that did not match runtime state when GetBoundName executed. This is a symbolic-to-object mapping failure ([CWE-386]) inside the speculative optimization layer of SpiderMonkey, not in interpreter-only execution.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts JavaScript designed to trigger the optimized code path. When a victim browses to the page in a vulnerable Firefox, Firefox ESR, or Thunderbird (with remote content enabled), the engine executes the malicious script. Successful exploitation can corrupt memory and provide a primitive for further sandbox-confined code execution.

No verified proof-of-concept code is publicly available. See the Mozilla Bug Report #1883542 for engine-level technical details.

Detection Methods for CVE-2024-3852

Indicators of Compromise

Firefox, Firefox ESR, or Thunderbird processes crashing with signatures referencing GetBoundName, BaselineIC, or IonMonkey after visiting untrusted pages.
Unexpected child processes spawned from firefox.exe or thunderbird.exe following web browsing or email rendering activity.
Outbound connections from browser processes to low-reputation domains immediately after a crash event.

Detection Strategies

Inventory browser and mail client versions and flag any host running Firefox < 125, Firefox ESR < 115.10, or Thunderbird < 115.10.
Correlate browser crash telemetry with subsequent process creation or network activity to surface post-exploitation behavior.
Monitor endpoint logs for SpiderMonkey JIT-related fault addresses inside browser processes.

Monitoring Recommendations

Enable Windows Error Reporting or equivalent crash telemetry forwarding for browser and Thunderbird binaries.
Alert on Thunderbird rendering remote HTML content from untrusted senders, which expands the attack surface for this flaw.
Track patch deployment status across the fleet using vulnerability management tooling and confirm version compliance.

How to Mitigate CVE-2024-3852

Immediate Actions Required

Update Firefox to version 125 or later on all managed endpoints.
Update Firefox ESR to 115.10 or later for environments standardized on the extended support release.
Update Thunderbird to 115.10 or later to remediate the embedded Gecko engine.
Apply Debian package updates per the Debian LTS Advisory April 2024 on Linux fleets.

Patch Information

Mozilla released fixes in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Detailed advisories are available at Mozilla Security Advisory MFSA-2024-18, Mozilla Security Advisory MFSA-2024-19, and Mozilla Security Advisory MFSA-2024-20. Linux distributions, including Debian LTS, have published corresponding package updates.

Workarounds

Configure Thunderbird to block remote content in messages, reducing exposure when patching cannot be completed immediately.
Restrict JavaScript execution on untrusted sites using enterprise browser policies or extensions such as NoScript.
Enforce browser auto-update policies through Group Policy or configuration management to prevent regression to vulnerable builds.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Enforce minimum version on Debian/Ubuntu via apt
sudo apt update && sudo apt install --only-upgrade firefox-esr thunderbird