CVE-2024-3860: Mozilla Firefox

Medium severity, CVSS 6.2. EPSS: 0.2% chance of exploitation in the next 30 days.

An out-of-memory condition during object initialization could result in an empty shape list. If the JIT subsequently traced the object it would crash. This vulnerability affects Firefox < 125.

Affected products

• Mozilla Firefox: before 125.0 (fixed in 125.0)

Published 2024-04-16. Last modified 2026-06-17.