CVE-2024-11691
📋 TL;DR
A WebGL vulnerability in Apple silicon M series devices allows out-of-bounds writes and memory corruption through Apple's GPU driver. This affects Firefox and Thunderbird browsers on Apple M series hardware only, potentially enabling arbitrary code execution. Other platforms are unaffected.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or ransomware deployment
Likely Case
Browser crash or denial of service, with potential for limited code execution in browser context
If Mitigated
No impact if browsers are updated to patched versions or if non-Apple M hardware is used
🎯 Exploit Status
Exploitation requires WebGL access which is typically enabled by default. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox ≥ 133, Firefox ESR ≥ 128.5, Firefox ESR ≥ 115.18, Thunderbird ≥ 133, Thunderbird ≥ 128.5, Thunderbird ≥ 115.18
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-63/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird
2. Click menu → Help → About Firefox/Thunderbird
3. Allow automatic update to complete
4. Restart browser when prompted
🔧 Temporary Workarounds
Disable WebGL
allPrevents exploitation by disabling WebGL functionality
In Firefox/Thunderbird address bar, type: about:config
Search for: webgl.disabled
Set value to: true
Use alternative browser
allTemporarily use a different browser on Apple M devices
🧯 If You Can't Patch
- Restrict browser usage to non-Apple M hardware
- Implement network filtering to block malicious WebGL content
🔍 How to Verify
Check if Vulnerable:
Check browser version in Help → About Firefox/Thunderbird and compare with affected versionsCheck Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Confirm browser version is at or above patched versions: Firefox ≥ 133, Firefox ESR ≥ 128.5 or ≥ 115.18, Thunderbird ≥ 133, Thunderbird ≥ 128.5 or ≥ 115.18📡 Detection & Monitoring
Log Indicators:
- Browser crash logs with WebGL-related errors
- Unexpected browser process termination
Network Indicators:
- Requests to known malicious domains hosting WebGL exploits
SIEM Query:
source="browser_logs" AND (event="crash" OR error="WebGL") AND device_hardware="Apple M series"🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1914707
- https://bugzilla.mozilla.org/show_bug.cgi?id=1924184
- https://www.mozilla.org/security/advisories/mfsa2024-63/
- https://www.mozilla.org/security/advisories/mfsa2024-64/
- https://www.mozilla.org/security/advisories/mfsa2024-65/
- https://www.mozilla.org/security/advisories/mfsa2024-67/
- https://www.mozilla.org/security/advisories/mfsa2024-68/
- https://www.mozilla.org/security/advisories/mfsa2024-70/
