When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Link | Tags |
---|---|
https://www.mozilla.org/security/advisories/mfsa2021-20/ | release notes vendor advisory |
https://bugzilla.mozilla.org/show_bug.cgi?id=1704227 | vendor advisory permissions required |