Description

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-29T13:17:41.250Z",
  "pubdate": "2026-09-29T13:17:41.250Z",
  "executiveSummary": "A critical use-after-free (UAF) vulnerability has been identified within the Document Object Model (DOM) implementation of the Firefox Content Processes component. This memory corruption flaw allows an attacker to manipulate object lifecycles, leading to potential sandbox escapes. By triggering the use of a dangling pointer, a malicious actor can achieve arbitrary code execution within the context of the content process, subsequently bypassing browser security boundaries. This vulnerability affects Firefox, Firefox ESR 153.4, Firefox ESR 115.42, and Firefox ESR 140.17. Given the nature of memory corruption, successful exploitation could lead to full compromise of the affected content process, potentially allowing the attacker to read sensitive data, inject malicious scripts, or escape the sandbox environment to interact with the host system. The flaw presents a significant risk to user data privacy and system integrity, necessitating immediate updates to the patched versions.",
  "technicalDetails": "The vulnerability resides in the DOM management logic within the Content Processes component of the Firefox browser engine. A use-after-free (UAF) condition occurs when the browser attempts to access a memory location that has been previously deallocated, typically due to improper reference counting or race conditions during the lifecycle management of DOM nodes or objects. In the context of browser internals, complex DOM manipulation—such as dynamic modifications of the node tree, event listener handling, or style recalculations—can trigger situations where a raw pointer to an object remains active after the object’s destructor has been invoked.\nExploitation of this UAF vulnerability generally follows a multi-stage attack flow. First, an attacker must trigger the premature destruction of a specific DOM object while maintaining a reference to it, often achieved through crafted JavaScript execution or heap-spraying techniques designed to manipulate the memory layout. Once the object is freed, the attacker occupies the vacated memory slot with controlled data (e.g., a fake object or payload). When the browser subsequently attempts to access the original dangling pointer, it inadvertently interacts with the attacker-controlled data instead of the legitimate object.\nBy controlling the structure of the forged object, an attacker can hijack the program's control flow. For instance, if the object contains a virtual method table (vtable), the attacker can overwrite the vtable pointer to redirect execution to a gadget chain or shellcode, effectively achieving arbitrary code execution within the content process. Because this component operates within a sandbox, the primary objective of such an exploit is typically to leverage this execution capability to perform further operations that exploit inter-process communication (IPC) flaws or kernel vulnerabilities, thereby facilitating a sandbox escape. This allows the attacker to elevate their privileges and escape the constraints of the content process to reach the main process or the underlying operating system. The vulnerability does not require authentication and can be exploited via remote network exposure by enticing a user to navigate to a malicious webpage containing the exploit payload."
}