CVE-2023-32209VulnerabilityPublished 19 Jun 2023Updated 27 May 2025

CVE-2023-32209: Mozilla Firefox · Persistent DoS via favicon image

Affects Mozilla FirefoxSource CVE Database V5

Not known to be exploited : upgrade to 113 when convenient.

Data as of 26 Oct 2026, 06:26 UTC

Severity

Medium

Rated Medium by the CNA (mozilla) · No CVSS score from NVD or the CNA

EPSS: 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 113

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jun 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Mozilla Firefox to 113.

Affected software

Product	Affected	Fixed in
Mozilla Firefox	Affected <113	Fixed in 113

AI-suggested

Organizations should prioritize updating Mozilla Firefox to version 113 or later, where this vulnerability is addressed. Automated patch management systems should be configured to deploy browser updates promptly. Network security teams can implement web filtering to block access to suspicious or untrusted websites that might host malicious favicons. Email security gateways should be tuned to detect and quarantine phishing emails containing links to potentially harmful favicons. For environments where immediate patching is not feasible, consider restricting Firefox usage or temporarily switching to alternative browsers until updates are applied. Security awareness training should include guidance on avoiding suspicious links and attachments that could lead to exposure to malicious favicons. Additionally, monitoring browser crash logs and user reports can help detect potential exploitation attempts. Enterprises might also consider deploying endpoint protection solutions capable of detecting abnormal memory consumption or repeated browser crashes indicative of this attack. Finally, organizations should maintain an inventory of Firefox versions in use across their infrastructure to ensure vulnerable versions are identified and remediated.

Description

A maliciously crafted favicon could have led to an out of memory crash. This vulnerability affects Firefox < 113.

Impact

For European organizations, this vulnerability poses a risk primarily to operational continuity and user productivity. Firefox is a widely used browser in Europe, both in private and enterprise environments. A persistent DoS caused by malicious favicons can disrupt web browsing activities, potentially affecting employees' ability to access web-based applications, internal portals, or cloud services. While this vulnerability does not directly lead to data breaches or integrity compromises, the forced crashes can cause loss of unsaved work, interrupt critical workflows, and increase helpdesk support costs. In sectors relying heavily on web applications, such as finance, government, healthcare, and education, repeated browser crashes can degrade service quality and user experience. Additionally, if attackers target specific organizations with crafted favicons embedded in phishing emails or compromised websites, they could selectively disrupt operations. Although no exploits are known in the wild, the ease of crafting malicious favicons and the widespread use of Firefox increase the potential attack surface. Organizations with strict uptime requirements or those using Firefox in kiosk or public access environments may face more significant operational impacts.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2025, 02:57 UTC

Technical details

References

Community reviews

Related threats