Proof of concept code has been made public that crashes Firefox 18.104.22.168, the open-source browser's newest edition.
Although Danish vulnerability tracker Secunia ranked the threat as "low," its weakest warning, U.S.-based security vendor Symantec said the danger may be more dire.
"It does appear that triggering the vulnerability using the proof of concept results in the execution of data somewhere in anonymous memory, possibly in a portion of the heap," Symantec told customers of its DeepSight threat alert system Tuesday. "If this memory were somehow populated by an attacker with a malicious payload, this condition could likely be exploited to execute arbitrary code."
Firefox developers have come up with a patch -- one is listed in the Bugzilla report -- but has not been pushed out to users. Typically, Mozilla releases Firefox updates that include several security patches as it did recently when it rolled out version 22.214.171.124 with fixes for 24 bugs.