Description

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:42.210Z",
  "pubdate": "2026-09-29T13:17:42.210Z",
  "executiveSummary": "This vulnerability is identified as a Use-After-Free (UAF) flaw within the JavaScript: WebAssembly component of Mozilla Firefox. A UAF vulnerability occurs when an application continues to use a memory pointer after it has been freed, potentially leading to arbitrary code execution, unauthorized memory access, or application crashes.\nThe flaw affects multiple versions of the Firefox browser, specifically impacting Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. The impact of successful exploitation is critical, as it may allow a remote, unauthenticated attacker to execute arbitrary code within the context of the browser process by leveraging a specially crafted WebAssembly module.\nThis vulnerability poses a significant risk to user privacy and system integrity, as it provides a vector for full system compromise if an attacker can bypass modern browser-based exploit mitigations such as Address Space Layout Randomization (ASLR) or Data Execution Prevention (DEP). Exploitation requires the victim to visit a malicious website or interact with crafted content designed to trigger the memory corruption in the WebAssembly engine. Users are strongly advised to update their software to the latest patched versions to eliminate the risk of exploitation.",
  "technicalDetails": "The vulnerability resides in the WebAssembly (Wasm) implementation within the Mozilla Firefox JavaScript engine. The root cause is a memory management error wherein the engine fails to correctly handle the lifecycle of objects during the compilation or execution of Wasm modules, resulting in a dangling pointer.\nA Use-After-Free condition occurs when the internal state of the WebAssembly engine permits a reference to an object to persist after the underlying memory has been deallocated. In the context of JavaScript engines, this typically involves the garbage collector or the object lifecycle management logic failing to synchronize with the execution flow of the Wasm sandbox.\nThe attack flow commences when an attacker delivers a malicious WebAssembly binary to a target browser. Upon loading or compiling this binary, the attacker triggers a sequence of operations that forces the engine to free memory associated with a specific Wasm object while concurrently maintaining a reference to it. By manipulating the heap layout through techniques such as heap spraying or controlled object allocation, the attacker attempts to occupy the newly freed memory slot with malicious data.\nOnce the attacker successfully replaces the freed object with attacker-controlled data, they invoke a method or perform an operation that accesses the original, now-dangling pointer. Because the engine expects the memory to contain a valid object structure, it executes operations based on the attacker's injected data. If the pointer relates to a function table or an object vtable, the attacker can hijack the control flow by redirecting execution to malicious shellcode or a Return-Oriented Programming (ROP) chain.\nThis vulnerability affects Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. Exploitation does not typically require prior authentication, and the attack is executed with the privileges of the browser process. Depending on the browser's sandbox architecture, successful exploitation may lead to a full sandbox escape, allowing the attacker to interact with the underlying operating system. The complexity of such exploits is high, as they require deep knowledge of the Firefox memory management architecture and the specific behaviors of the IonMonkey or Baseline compilers used in Wasm processing."
}