Description

Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 157.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:40.390Z",
  "pubdate": "2026-09-29T13:17:40.390Z",
  "executiveSummary": "A critical use-after-free vulnerability exists within the WebGPU component of the Firefox browser, specifically identified in versions prior to 157.\nThe vulnerability resides in the memory management logic of the graphics subsystem, allowing an attacker to manipulate heap-allocated objects after they have been freed.\nSuccessful exploitation of this flaw can lead to privilege escalation, enabling an attacker to execute arbitrary code within the context of the browser process.\nThis poses a severe security risk, as an attacker could bypass browser sandbox restrictions, compromise user data, or gain unauthorized control over the host system.\nThe exploit typically requires an attacker to lure a user to a malicious web page that triggers the flaw via specially crafted WebGPU API calls.\nNo authentication is required to trigger the vulnerability, as it is exposed through standard web content rendering processes.\nImmediate patching to Firefox 157 or later is required to mitigate the risk of remote code execution.",
  "technicalDetails": "The vulnerability is a classic use-after-free (UAF) condition rooted in the Graphics: WebGPU component. This flaw occurs due to a race condition or an incorrect object lifetime management policy during the lifecycle of WebGPU resources, such as buffers, textures, or command encoders.\nIn the context of the WebGPU implementation, the browser allocates objects on the heap to manage GPU state and command queues. The UAF condition arises when a pointer to a specific object remains active after the object's underlying memory has been released (freed) by the allocator, typically due to an premature cleanup call or an error-handling path that fails to invalidate references held by other threads or objects.\nThe attack flow begins when a malicious actor crafts a web page leveraging the WebGPU API to perform a sequence of rapid allocations and deallocations. By inducing a state where an object is freed while still being referenced by another part of the WebGPU engine, the attacker can influence the heap layout.\nOnce the target object is freed, the attacker attempts to perform a heap grooming operation—filling the vacated memory space with attacker-controlled data. When the browser subsequently attempts to access the 'stale' pointer, it inadvertently interacts with the attacker's injected data instead of the original, legitimate object state.\nThis redirection allows the attacker to hijack the control flow of the browser process. By overwriting function pointers or object vtables within the heap, the attacker can divert execution to a malicious payload or shellcode. Given that the WebGPU component often operates with elevated access to graphics drivers or internal browser structures, achieving code execution through this vector often allows for sandbox escapes and full escalation of privileges to the user level.\nBecause the WebGPU API is accessible from standard JavaScript within the browser, there are no specific authentication or specialized privilege requirements for an attacker; the malicious script runs with the standard permissions granted to any web page. The exposure is universal to all users running versions of Firefox prior to 157, as the vulnerable code is part of the core browser rendering engine."
}