Description

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:40.047Z",
  "pubdate": "2026-09-29T13:17:40.047Z",
  "executiveSummary": "A use-after-free vulnerability has been identified within the Widget component of Firefox. This memory corruption flaw allows an attacker to manipulate application state by referencing deallocated memory, leading to potential arbitrary code execution or unexpected application behavior.\nThe vulnerability affects multiple versions, including Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.\nSuccessful exploitation generally requires the execution of malicious scripts or the navigation to a crafted web page capable of triggering the vulnerable memory access pattern.\nThe risk implication is critical, as a successful exploitation could allow an attacker to bypass browser security sandboxes, execute arbitrary code under the context of the current user, or achieve persistent compromise of the host system.\nThere are no specific authentication requirements mentioned, suggesting that unauthenticated, remote attackers could leverage this flaw via standard browser interactions.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of object lifecycles within the Widget component. A use-after-free occurs when an application continues to use a pointer to a memory location after that memory has been explicitly freed or deallocated by the memory manager.\nIn the context of the Firefox Widget component, this suggests a failure in reference counting or an incorrect state transition that leaves a 'dangling pointer' in an active component path. When the application logic subsequently attempts to access, read from, or write to the memory address associated with the dangling pointer, it accesses data that may have already been reclaimed and repurposed by the heap manager for other object types.\nThe attack flow typically begins with an attacker inducing a state where the Widget component holds a reference to a memory block scheduled for deallocation. By triggering a specific sequence of DOM operations, layout updates, or event handling cycles, an attacker can force the component to release the memory prematurely while maintaining an active reference to it.\nOnce the memory is free, an attacker can attempt 'heap grooming' or 'heap spraying' to populate the deallocated memory block with controlled data. When the vulnerable Widget component performs a read or write operation using the dangling pointer, it effectively operates on the attacker-supplied data.\nIf the dangling pointer is used for a function pointer call, the attacker can redirect the execution flow to an arbitrary location, such as ROP (Return-Oriented Programming) chains or shellcode injected into the process space, thereby gaining control over the process execution.\nThe scope of impact is broad, as this vulnerability resides within the rendering engine components, potentially bypassing browser-level protections if the exploit can successfully bridge the gap between memory corruption and code execution within the browser's process model.\nAffected versions include Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The exploit remains viable as long as the memory management logic in the Widget component does not correctly synchronize the destruction of the object with all potential consumer references."
}