Mozilla Firefox and Thunderbird Use-After-Free Vulnerability Due to Concurrent Delazification

A use-after-free vulnerability has been identified in Mozilla Firefox and Thunderbird. This issue arises from a race condition during concurrent delazification, which could potentially be exploited. The vulnerability affects multiple versions of Firefox and Thunderbird, including Firefox prior to 135, Firefox ESR versions prior to 115.20 and 128.7, as well as Thunderbird versions prior to 128.7 and 135.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, commonly associated with memory corruption issues that can be exploited to execute arbitrary code.

Remediation

Users can upgrade to Firefox 135, Firefox ESR 115.20 or 128.7, or Thunderbird 128.7 or 135 to address this vulnerability.