Description

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:41.143Z",
  "pubdate": "2026-09-29T13:17:41.143Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the WebAssembly (Wasm) component of the Firefox browser engine. This memory safety flaw allows for the manipulation of heap-allocated objects after they have been deallocated, leading to potentially exploitable conditions.\nThe vulnerability affects Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. If successfully exploited, an attacker could achieve arbitrary code execution, bypass browser security sandboxes, or cause a denial-of-service state through memory corruption.\nThe flaw stems from improper lifecycle management of internal Wasm-related objects. An attacker can trigger this vulnerability by crafting malicious WebAssembly modules that induce a dangling pointer reference within the browser's memory management subsystem.\nThis vulnerability is particularly dangerous as it does not require prior authentication or elevated privileges; it can be exploited remotely by enticing a user to navigate to a compromised or malicious web page containing the exploit code. The potential for sandbox escape makes this a high-risk security event, necessitating immediate patching of affected browser versions.",
  "technicalDetails": "The root cause of this vulnerability is a Use-After-Free condition residing in the WebAssembly engine's memory management logic. In the context of Firefox's Wasm implementation, complex objects, such as compiled modules or exported functions, are managed through the engine's memory allocator. When a module or component is incorrectly finalized or garbage collected, a reference to the memory location may persist in an active state.\nThe vulnerability occurs when a stale pointer—a dangling reference—points to a memory region that has already been returned to the allocator. If the allocator subsequently reassigns this memory block to a different object, the original stale pointer still references the new data structure. An attacker can leverage this by precisely grooming the heap, ensuring that a controlled object (containing attacker-supplied data) is placed at the location previously occupied by the freed Wasm object.\nThe attack flow typically follows these steps: First, the attacker delivers a specially crafted WebAssembly module via a web context. Upon execution, the module performs operations designed to trigger the premature release of specific internal objects while maintaining a reference to them in the script environment. Second, the attacker uses heap spraying or other memory layout manipulation techniques to populate the freed memory slot with data that influences the browser's execution flow, such as function pointers or vtable pointers.\nOnce the dangling pointer is dereferenced, the engine inadvertently performs operations on the attacker-controlled data, treating it as a legitimate internal object. If the overwritten memory contains a hijacked vtable pointer, the attacker can redirect the execution flow to a chosen instruction sequence, such as a Return-Oriented Programming (ROP) chain. This allows the attacker to bypass platform-level security mitigations, including Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), potentially resulting in full system compromise from within the renderer process context.\nThe vulnerability affects Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. Exploitation is facilitated via the browser's JavaScript engine, which interfaces with the WebAssembly runtime. Since the browser manages untrusted content, this vulnerability effectively bridges the gap between sandboxed script execution and native code execution on the underlying host operating system."
}