A critical use-after-free flaw in the IPC component of Mozilla Firefox and Thunderbird exposes users to potential remote code execution and system compromise.

This is a use-after-free vulnerability located within the Inter-Process Communication (IPC) component. An unauthenticated remote attacker can trigger this flaw by enticing a user to interact with malicious web content, leading to memory corruption.

The vulnerability carries a CVSS score of 8.8, indicating a high level of severity. Successful exploitation could allow an attacker to achieve remote code execution on the host system, resulting in full loss of confidentiality, integrity, and availability. This poses a significant risk to organizational endpoints and sensitive data access.

Immediate Action: Update Mozilla Firefox and Thunderbird to the fixed versions (147 or the specified ESR releases) immediately.

Proactive Monitoring: Monitor endpoint crash logs for repeated, anomalous browser process terminations which may indicate exploitation attempts.

Compensating Controls: Ensure that browser security settings are configured to restrict script execution and utilize endpoint protection solutions that can detect unauthorized memory manipulation.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of the flaw, organizations should prioritize deploying these security updates across all workstations. Prompt patching is the only effective way to neutralize the risk of remote code execution posed by this vulnerability.