Description

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:42.337Z",
  "pubdate": "2026-09-29T13:17:42.337Z",
  "executiveSummary": "This vulnerability is identified as a Use-After-Free (UAF) flaw within the Graphics: Canvas2D component of the Firefox browser architecture.\nThe vulnerability occurs due to improper memory management, where a pointer remains active after the associated object has been deallocated.\nAffected products include Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.\nSuccessful exploitation allows a remote attacker to achieve arbitrary code execution or cause application instability by triggering memory corruption.\nThe attack typically involves convincing a user to navigate to a malicious website containing crafted Canvas2D operations, requiring no specific user authentication.\nThe risk implication is critical, as it bypasses standard browser security boundaries, potentially leading to unauthorized data access or full system compromise under the security context of the user process.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper lifecycle management of memory objects within the Canvas2D graphics rendering engine. A use-after-free condition arises when the Graphics component continues to hold a dangling pointer to an object that has already been cleared or freed from heap memory.\nIn the context of the Canvas2D implementation, the vulnerability is triggered during specific sequences of rendering operations where the application fails to synchronize memory access correctly. When the engine attempts to perform operations on an object that has undergone a premature free, the application accesses stale, potentially attacker-controlled, or reallocated memory locations.\nThe attack flow typically proceeds as follows: First, the attacker identifies a race condition or a specific sequence of API calls within the HTML5 Canvas context that forces a deallocation of a specific internal Graphics object while it remains referenced by an asynchronous process or a cached event handler. Second, the attacker performs heap spraying or memory grooming to fill the newly deallocated memory space with controlled data. Finally, the Graphics engine attempts to use the dangling pointer, triggering an access to the attacker-supplied data.\nExploitation of this UAF vulnerability enables an attacker to manipulate the function pointers or object vtables stored in the heap, redirecting the execution flow to arbitrary code (e.g., Return-Oriented Programming or shellcode). Because the vulnerability resides within the Graphics component, the exploitation does not require prior authentication or elevated privileges beyond the standard execution context of the browser.\nThe impact of a successful exploit extends to full process takeover. By hijacking the control flow, an attacker can bypass browser sandboxing to read or modify sensitive data, install persistent malware, or move laterally within the victim's environment. The lack of memory safety validation in the affected versions allows the browser to process malicious rendering commands that lead directly to memory corruption, underscoring the severity of the flaw in the memory-management subsystem of the Firefox Graphics stack."
}