CVE-2024-4764
📋 TL;DR
A use-after-free vulnerability in Firefox's WebRTC audio input handling allows multiple threads to claim the same audio connection, potentially leading to memory corruption. This affects Firefox versions before 126 and could allow remote code execution. Users running vulnerable Firefox versions are at risk when visiting malicious websites.
💻 Affected Systems
- Mozilla Firefox
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, allowing attackers to install malware, steal data, or create persistent backdoors.
Likely Case
Browser crash leading to denial of service, with potential for limited code execution in browser context.
If Mitigated
Browser crash with no data loss if sandboxing works properly, requiring user to restart browser.
🎯 Exploit Status
Exploitation requires user to visit malicious website, but no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 126
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-21/
Restart Required: Yes
Instructions:
1. Open Firefox. 2. Click menu → Help → About Firefox. 3. Firefox will check for updates and install Firefox 126. 4. Restart Firefox when prompted.
🔧 Temporary Workarounds
Disable WebRTC
allDisables WebRTC functionality which prevents exploitation but breaks audio/video calls in browser.
about:config → media.peerconnection.enabled → false
🧯 If You Can't Patch
- Use alternative browser until Firefox can be updated
- Implement network filtering to block suspicious websites
🔍 How to Verify
Check if Vulnerable:
Check Firefox version: about:support → Application Basics → Version. If version < 126, vulnerable.Check Version:
firefox --versionVerify Fix Applied:
Verify Firefox version is 126 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Firefox crash reports with WebRTC-related stack traces
- Unexpected browser process termination
Network Indicators:
- Multiple WebRTC connection attempts to same audio device
- Suspicious website visits triggering audio device access
SIEM Query:
source="firefox.logs" AND ("WebRTC" OR "audio input" OR "use-after-free") AND severity=CRITICAL