Description

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-29T13:17:40.470Z",
  "pubdate": "2026-09-29T13:17:40.470Z",
  "executiveSummary": "This vulnerability is a memory safety issue categorized as a use-after-free (UAF) within the Document Object Model (DOM) implementation of Firefox's Content Processes.\nThe flaw allows an attacker to bypass the browser's sandbox security boundary, potentially leading to arbitrary code execution within the context of the host operating system.\nAffected products include Firefox, Firefox ESR 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.\nSuccessful exploitation requires the ability to trigger a memory corruption event, typically through a maliciously crafted web page, allowing an attacker to escape the restricted content process.\nThe risk implication is critical, as a sandbox escape facilitates privilege escalation and circumvention of the browser's defense-in-depth mechanisms, enabling persistent compromise of the user's system.",
  "technicalDetails": "The vulnerability resides within the DOM component responsible for processing web content. A use-after-free condition occurs when memory is freed while a dangling pointer remains active in the application's memory space, pointing to the deallocated region.\nIn this specific context, the flaw arises during the lifecycle management of DOM objects within the Content Processes. If the browser fails to properly synchronize object lifetimes, specifically when garbage collection or object destruction routines are triggered, an attacker can manipulate the state of the heap.\nExploitation involves a multi-stage attack flow. Initially, an attacker must force the browser to retain a reference to a memory address that has been deallocated. This is often achieved through carefully orchestrated JavaScript execution that triggers specific DOM tree mutations or event handling sequences.\nOnce the dangling pointer is established, the attacker attempts to perform heap grooming or spraying to reallocate the freed memory block with controlled data. When the application subsequently attempts to dereference the dangling pointer, it accesses the attacker-controlled memory instead of the original object.\nBy controlling the contents of the reallocated memory, an attacker can overwrite function pointers, virtual method tables (vtable), or other control-flow-critical structures. Redirecting the execution flow to a payload—often a Return-Oriented Programming (ROP) chain—bypasses non-executable memory protections such as Data Execution Prevention (DEP).\nThis control-flow hijacking enables the execution of arbitrary code within the sandboxed Content Process. Because the vulnerability involves a sandbox escape, the payload can leverage the primitive to interact with the underlying browser process or the operating system's IPC (Inter-Process Communication) mechanisms, effectively escalating privileges and breaking out of the confined execution environment.\nThe vulnerability does not require authentication, as the execution is triggered client-side through standard web interactions. The network exposure is limited only by the attacker's ability to host a malicious page that the target user visits.\nThe root cause is a failure in the memory management logic of the Content Processes, necessitating a strict adherence to object ownership protocols to ensure that all references to a heap object are nullified or updated before the memory is returned to the allocator.\nAffected versions include Firefox 157 and specific ESR branches (153.4, 115.42, 140.17). Mitigation relies entirely on the provided vendor patches which correct the object lifecycle state machine to prevent premature deallocation."
}