Description

Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:40.940Z",
  "pubdate": "2026-09-29T13:17:40.940Z",
  "executiveSummary": "A use-after-free vulnerability has been identified within the Networking: Cache component of the Firefox browser architecture. This memory safety flaw occurs when the application attempts to access a memory location that has already been deallocated, leading to undefined behavior.\nThe vulnerability affects multiple releases, including Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.\nExploitation of this flaw can lead to memory corruption, potentially allowing an attacker to achieve arbitrary code execution or cause an application crash. The impact is significant as it compromises the integrity and confidentiality of the browser's execution environment.\nSuccessful exploitation typically requires a malicious actor to induce specific state transitions within the cache management logic, often through crafted web content. Users are at risk of remote code execution if they navigate to a malicious site or interact with manipulated networking resources that trigger the use-after-free condition. Given the nature of memory management vulnerabilities, this issue presents a critical security risk necessitating immediate patching to maintain browser integrity.",
  "technicalDetails": "The vulnerability resides in the Networking: Cache component, which is responsible for managing localized storage of network-retrieved resources to optimize browser performance. A use-after-free condition arises when a pointer referencing a memory object remains active after the object has been freed or reallocated by the memory manager. In the context of the browser's cache subsystem, this typically involves a race condition or an improper lifecycle management of objects during complex asynchronous network requests or cache eviction processes.\nThe attack flow begins when an attacker influences the browser to perform a sequence of network operations that forces the cache component to deallocate an object while another part of the system maintains a dangling reference to that memory address. Once the memory is freed, the allocator may reassign that same memory block for a different, potentially attacker-controlled object. When the application subsequently attempts to perform operations using the original dangling pointer, it inadvertently interacts with the newly allocated memory instead of the intended data structure.\nFrom an exploitation perspective, this allows an attacker to gain control over the instruction pointer or modify critical data structures within the application's address space. By carefully crafting the heap layout, an attacker may trigger a write-what-where primitive or facilitate control-flow hijacking. Because the cache component handles serialized network data, the payload could be delivered via specially crafted HTTP responses or via a sequence of fetch requests that manipulate the cache's internal state. This vulnerability does not strictly require local access or authentication, as it is reachable via standard web interaction, making it particularly dangerous in a remote exploitation scenario.\nThe affected versions are explicitly identified as Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The technical complexity involves the lifecycle management of cache entries, where an asynchronous cleanup task might finalize an object while an active networking thread still holds a reference to it. Without sufficient synchronization or smart pointer usage that guarantees object lifetime validity, the application inevitably suffers from a memory safety breach when the dangling pointer is accessed. Post-exploitation, the attacker can bypass sandboxing or execute arbitrary code under the context of the Firefox process, leading to a complete compromise of the browser session."
}