CVE-2023-29551

Vulnerability

Firefox 111 and earlier versions (Firefox for Android < 112, Firefox < 112, and Focus for Android < 112) contain multiple memory safety bugs that showed evidence of memory corruption [1]. These bugs affect the core browser engine and could be triggered through various web content interactions.

Exploitation

An attacker could exploit these vulnerabilities by hosting malicious web content that triggers memory corruption. No user interaction beyond visiting the malicious webpage is required. The attacker does not need any special privileges or network position beyond serving the content [2].

Impact

Successful exploitation could allow the attacker to run arbitrary code in the context of the browser process. This could lead to full compromise of the user's browsing session, including data theft, extension manipulation, and system access [1].

Mitigation

These vulnerabilities are fixed in Firefox 112, Firefox for Android 112, and Focus for Android 112, released on April 11, 2023 [1]. Users should update to the latest version of their respective browser. No workarounds are available.