Mozilla Firefox and Thunderbird JIT Vulnerability in WebAssembly Return Value Handling on 64-bit CPUs

A vulnerability exists in Mozilla Firefox versions prior to 136, Firefox ESR versions prior to 115.21 and 128.8, and Thunderbird versions prior to 136 and 128.8. On 64-bit processors, the Just-In-Time (JIT) compiler can improperly handle WebAssembly (WASM) integer return values by incorporating residual bits from memory. This mismanagement may lead to the values being misinterpreted as different data types.

Impact

Exploitation of this vulnerability can cause memory corruption, allowing for arbitrary code execution.

Remediation

Users can upgrade to Firefox 136, Firefox ESR 115.21 or 128.8, or Thunderbird 136 or 128.8 to address this vulnerability.