When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, and Thunderbird < 115.2.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-4575
• https://bugzilla.mozilla.org/show_bug.cgi?id=1846689
• https://www.mozilla.org/security/advisories/mfsa2023-34
• https://www.mozilla.org/security/advisories/mfsa2023-35
• https://www.mozilla.org/security/advisories/mfsa2023-36
• https://www.mozilla.org/security/advisories/mfsa2023-37
• https://www.mozilla.org/security/advisories/mfsa2023-38