CVE-2024-8384: Mozilla Firefox Use-After-Free Vulnerability

CVE-2024-8384 Overview

CVE-2024-8384 is a memory corruption vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird. The flaw resides in the SpiderMonkey JavaScript garbage collector (GC), which could mis-color cross-compartment objects when out-of-memory (OOM) conditions occurred between two GC passes. An attacker who triggers the precise OOM timing through crafted JavaScript can corrupt memory in the browser process. Mozilla rates the issue as high-impact, and public scoring systems classify it as critical with a network attack vector and no required privileges or user interaction.

Critical Impact
Memory corruption in the JavaScript engine can be leveraged for arbitrary code execution within the browser content process when a victim loads attacker-controlled web content.

Affected Products

Mozilla Firefox versions prior to 130
Mozilla Firefox ESR versions prior to 128.2 and prior to 115.15
Mozilla Thunderbird versions prior to 128.2 and prior to 115.15

Discovery Timeline

2024-09-03 - CVE-2024-8384 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-8384

Vulnerability Analysis

The defect lives in the SpiderMonkey garbage collector. SpiderMonkey isolates JavaScript objects into compartments, and the GC tracks object reachability using a tri-color marking algorithm. When the collector encounters an OOM condition between two marking passes, it can mis-color objects that span compartments. A mis-colored object may be treated as unreachable and freed while live references still exist, or vice versa.

The outcome is a memory corruption primitive aligned with CWE-416 (Use After Free) and CWE-787 (Out-of-bounds Write). Once corruption occurs, an attacker controlling the surrounding heap layout can pivot to read or write arbitrary memory inside the content process.

Root Cause

The root cause is a state inconsistency in the incremental GC. The OOM handling path does not preserve cross-compartment marking invariants between sweeping phases. Objects referenced from another compartment can be assigned a color that no longer reflects their true reachability state, breaking the soundness of incremental collection.

Attack Vector

Exploitation requires a victim to navigate to attacker-controlled web content. The attacker uses JavaScript to allocate large objects, force memory pressure, and trigger OOM at the precise GC phase boundary. Successful exploitation typically yields code execution within the renderer sandbox, which can be chained with a sandbox escape for full system compromise. Refer to Mozilla Bug 1911288 for technical specifics.

No verified public proof-of-concept code is available. See the Mozilla Security Advisory MFSA-2024-39 for vendor analysis.

Detection Methods for CVE-2024-8384

Indicators of Compromise

Unexpected Firefox or Thunderbird content process crashes with signatures referencing js::gc, mark phase, or compartment sweeping
Browser child processes spawning shell interpreters, scripting hosts, or unsigned binaries from the user profile directory
Outbound connections from firefox.exe or thunderbird.exe to newly registered or low-reputation domains immediately after page load

Detection Strategies

Inventory installed Firefox, Firefox ESR, and Thunderbird versions across the fleet and flag any below the fixed releases (Firefox 130, ESR 128.2, ESR 115.15, Thunderbird 128.2, Thunderbird 115.15)
Hunt for anomalous child processes of browser binaries, especially cmd.exe, powershell.exe, bash, or osascript
Correlate browser crash telemetry with subsequent process creation or network activity within a short time window

Monitoring Recommendations

Forward browser crash reports and EDR telemetry to a central data lake for correlation against patch status
Alert on Firefox or Thunderbird processes writing executable content to disk or modifying autostart locations
Track DNS and HTTP telemetry for visits to domains hosting heap-grooming or JavaScript exploitation frameworks

How to Mitigate CVE-2024-8384

Immediate Actions Required

Update Firefox to version 130 or later on all managed endpoints
Update Firefox ESR to 128.2 or 115.15 depending on the deployed branch
Update Thunderbird to 128.2 or 115.15 depending on the deployed branch
Apply the corresponding Debian LTS updates on affected Linux systems per the Debian LTS Announcement

Patch Information

Mozilla released fixes in coordinated security advisories MFSA-2024-39, MFSA-2024-40, MFSA-2024-41, MFSA-2024-43, and MFSA-2024-44. The patches correct the cross-compartment marking logic so that OOM conditions between GC passes no longer leave objects in an inconsistent color state.

Workarounds

Disable JavaScript for untrusted sites using enterprise policy where compatibility allows
Restrict browser usage to vetted internal sites until patches are deployed
Enforce strict site isolation and sandboxing settings via enterprise policy templates

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Example enterprise policy snippet (policies.json) to disable JavaScript on untrusted sites
# /etc/firefox/policies/policies.json
{
  "policies": {
    "JavaScriptBlockedForUrls": ["<all_urls>"],
    "JavaScriptAllowedForUrls": ["https://intranet.example.com"],
    "DisableAppUpdate": false
  }
}