Mozilla Firefox and Thunderbird Cross-Process Memory Leak Vulnerability via IPC Messages

A vulnerability exists in Mozilla Firefox versions prior to 144, Firefox ESR versions prior to 115.29 and 140.4, as well as Thunderbird versions prior to 144 and 140.4. This vulnerability allows a compromised web process to use malicious inter-process communication (IPC) messages to manipulate the privileged browser process into disclosing blocks of its memory.

Impact

Exploitation of this vulnerability could lead to unauthorized access to memory blocks in the privileged browser process, potentially allowing for further exploitation or information leakage.

Remediation

Users can upgrade to Firefox 144, Firefox ESR 115.29 or 140.4, or Thunderbird 144 or 140.4 to address this vulnerability.