CVE-2023-4583
HIGHFirefox < 117 and Firefox ESR < 115.2 - Use-After-Free in HttpBaseChannel
Title source: llmDescription
When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
References (4)
Core 4
Core References
Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=1842030
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-34/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-36/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-38/
Scores
CVSS v3
7.5
EPSS
0.0015
EPSS Percentile
34.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-754
Status
published
Products (3)
mozilla/firefox
< 117.0
mozilla/firefox_esr
< 115.2
mozilla/thunderbird
< 115.2
Published
Sep 11, 2023
Tracked Since
Feb 18, 2026