Description

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:43.927Z",
  "pubdate": "2026-09-29T13:17:43.927Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified within the Graphics: Canvas2D component of the Firefox browser. This memory corruption flaw allows a remote attacker to trigger an invalid memory access by manipulating the lifecycle of objects within the Canvas2D rendering pipeline.\nThe vulnerability exists when the application attempts to reference a memory address that has already been deallocated. Successful exploitation may allow an attacker to achieve arbitrary code execution within the context of the browser process, potentially bypassing security boundaries such as sandboxing.\nAffected products include Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The risk profile is high, as the exploitation of memory corruption vulnerabilities in graphics components often does not require specific user authentication or elevated privileges, provided the user can be induced to navigate to a malicious web page hosting a crafted canvas payload.\nTo mitigate this risk, users and administrators must upgrade to the patched versions immediately. The vulnerability emphasizes the necessity of robust memory management in browser rendering engines to prevent exploitation of dangling pointers.",
  "technicalDetails": "The vulnerability is rooted in the Graphics: Canvas2D component, where improper management of object lifecycles results in a Use-After-Free condition. In a typical rendering architecture, Canvas2D operations utilize internal buffers and object references to track state and handle drawing commands. If a race condition or a logic error occurs where an object is explicitly destroyed or garbage collected while a reference to that object remains in active use by the renderer, the subsequent access to the dangling pointer triggers the UAF state.\nExploitation flow typically begins with an attacker injecting malicious JavaScript into the browser environment, specifically targeting the Canvas API. By orchestrating a sequence of operations that cause a target object—such as a specific Canvas rendering context or associated memory buffer—to be freed, the attacker creates a 'hole' in the heap. The attacker then employs heap grooming techniques, such as spraying the heap with controlled data, to reallocate the freed memory block with malicious content. When the vulnerable component subsequently attempts to use the original dangling pointer, it inadvertently executes code or accesses data controlled by the attacker.\nThe lack of memory safety in the underlying C++ components of the rendering engine allows this memory corruption to be leveraged into a primitive for arbitrary code execution. Because the Canvas2D component operates within the rendering process, successful exploitation can lead to a compromise of the sandbox boundary. The attack does not require prior authentication and can be executed over the network if the browser visits a malicious or compromised web page containing the exploit.\nThe vulnerability affects multiple versions across different release channels, specifically: Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. The technical impact is significant as it facilitates potential cross-origin data theft or arbitrary command execution depending on the attacker's ability to weaponize the memory corruption relative to the browser's current exploit mitigations, such as Control Flow Guard (CFG) or Address Space Layout Randomization (ASLR). Post-exploitation activity typically involves the deployment of a secondary payload or the exfiltration of sensitive session data accessible from the rendering process memory space."
}