CVE-2023-37202

HighCVSS 8.8

Published: 05/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.70%

48th percentile - higher than 48% of all known CVEs

Summary

CVE-2023-37202 affects outdated versions of Firefox and Thunderbird, where improper management of objects from different compartments may lead to a use-after-free situation.

Risk Assessment

Exploitation of this vulnerability could allow attackers to access memory, potentially leading to arbitrary code execution or data leakage.

Recommendation

It is recommended to update to the latest versions of Firefox (≥ 115), Firefox ESR (≥ 102.13), and Thunderbird (≥ 102.13) to mitigate this vulnerability.

Other vulnerabilities in Firefox < 115, Firefox ESR < 102.13, Thunderbird < 102.13

CVE-2023-37207Medium
The vulnerability allowed a website to obscure the fullscreen notification by using a URL handled by an external program, which could lead to user confusion and potential spoofing attacks.

Original NVD description (English source)

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS