Description

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:41.717Z",
  "pubdate": "2026-09-29T13:17:41.717Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified within the Storage: IndexedDB component of the Mozilla Firefox browser. This memory corruption flaw occurs when the application attempts to access a memory location after it has been explicitly deallocated. Successful exploitation of this vulnerability allows a remote attacker to trigger arbitrary code execution within the context of the browser process, potentially leading to a full system compromise. The vulnerability affects multiple release channels, including Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The impact is severe, as it permits an attacker to bypass standard browser security sandboxing if combined with additional primitives. Attackers typically require the user to navigate to a malicious web page that triggers the malformed IndexedDB operations. Given the nature of UAF vulnerabilities, the primary risk involves unauthorized data access, persistence, or denial-of-service conditions. Organizations must prioritize applying the specified security updates to remediate the flaw and protect browser integrity.",
  "technicalDetails": "The vulnerability originates from improper management of object lifecycles within the Storage: IndexedDB component, specifically concerning the synchronization of asynchronous database transactions and the underlying memory management of objects. A Use-After-Free condition occurs when a pointer to an IndexedDB object—such as a cursor, database request, or transaction handle—remains valid after the associated memory has been freed by the garbage collector or manual deallocation routines.\nThe attack flow typically initiates when an attacker induces the IndexedDB engine to perform a sequence of operations that create a race condition or a state inconsistency. By carefully crafting JavaScript sequences that initiate multiple, overlapping transactions or trigger unexpected callbacks during database state transitions, an attacker can leave dangling pointers in the application state. When the browser subsequently attempts to access the deallocated memory block, it performs a dereference on an object that may have been repurposed by the attacker.\nExploitation involves heap grooming to gain control over the memory layout. By forcing the browser to allocate and free specific objects, an attacker can facilitate a heap spray or heap massage to ensure that the previously freed address is reallocated with malicious data controlled by the attacker. This malicious payload often replaces the function pointers or virtual method tables (vtable) within the object structure. Once the browser attempts to execute a method on the 'freed' object, the control flow is redirected to an attacker-controlled address, leading to arbitrary code execution (ACE).\nThis vulnerability is particularly dangerous because IndexedDB operations are pervasive in modern web applications. The flaw does not necessarily require complex user interaction beyond visiting a malicious site, making it a viable vector for drive-by download attacks. The lack of proper reference counting or lifecycle tracking in the affected component allows for this memory corruption. As the browser operates with high privileges relative to the user's local filesystem and data, the post-exploitation impact includes the potential for persistent malware installation, data exfiltration from the IndexedDB stores, or cross-origin policy bypasses depending on the browser's internal isolation state at the time of execution. The issue is restricted to the specific versions mentioned, and remediation requires the deployment of patches provided by Mozilla to properly synchronize object reference counts."
}