Description

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:40.730Z",
  "pubdate": "2026-09-29T13:17:40.730Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified within the WebAssembly (Wasm) engine of the JavaScript component in Firefox.\nThis memory safety flaw allows a remote attacker to trigger a heap-use-after-free condition, potentially leading to arbitrary code execution, unauthorized data access, or browser process crashes.\nThe vulnerability affects Firefox ESR 153.4 and prior, and Firefox 157 and prior versions.\nExploitation generally requires a user to navigate to a malicious web page containing crafted WebAssembly modules designed to trigger memory corruption.\nSuccessful exploitation allows an attacker to manipulate the browser's memory management, enabling the execution of arbitrary machine code with the privileges of the active user session.\nGiven the nature of UAF vulnerabilities, this issue represents a significant risk to confidentiality, integrity, and availability, as it effectively bypasses standard memory protection mechanisms within the browser sandbox.\nDefensive measures require immediate updates to the patched versions to eliminate the underlying memory management defect.",
  "technicalDetails": "The vulnerability resides within the JavaScript engine's WebAssembly component, specifically concerning the lifecycle management of objects handled during Wasm compilation or execution.\nA Use-After-Free occurs when an application continues to use a memory pointer after the memory it references has been explicitly deallocated or freed.\nIn the context of the Firefox Wasm implementation, this flaw is triggered when the engine incorrectly manages the reference count or the object lifetime of a Wasm-related internal structure during concurrent operations or specific state transitions.\nWhen the memory is freed, the associated pointer becomes 'dangling'. If an attacker can control the subsequent allocation of that memory segment—a technique often referred to as 'heap spraying'—they can force the application to use data under their control as if it were a valid, legitimate object.\nThe attack flow typically involves three stages: First, the attacker provides a malicious WebAssembly module that induces an unstable state in the Wasm compilation pipeline or runtime memory management. Second, the attacker triggers the premature deallocation of a critical object while maintaining a pointer to it. Third, the attacker leverages 'heap grooming' to populate the freed memory slot with controlled data, such as a fake vtable or function pointers.\nWhen the engine subsequently attempts to invoke a method or access a field on the dangling pointer, it inadvertently executes the attacker's payload. In advanced exploitation scenarios, this primitive can be used to bypass Control Flow Guard (CFG), Address Space Layout Randomization (ASLR), and Data Execution Prevention (DEP) by redirecting execution flow to Return-Oriented Programming (ROP) gadgets.\nThe vulnerability is inherent to the browser's internal engine and does not require local authentication; however, it is constrained by the browser's sandbox architecture. If successfully exploited, the attacker transitions from web content execution to arbitrary code execution within the renderer process, necessitating a secondary sandbox escape vulnerability to gain full system persistence.\nAffected versions include all Firefox iterations prior to the security updates in Firefox ESR 153.4 and Firefox 157, where the specific path management logic in the Wasm engine has been corrected to ensure proper synchronization and object lifetime guarantees."
}