Description

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 157.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:44.650Z",
  "pubdate": "2026-09-29T13:17:44.650Z",
  "executiveSummary": "This vulnerability involves a use-after-free (UAF) flaw located within the JavaScript WebAssembly (Wasm) engine of the Firefox browser.\nA use-after-free occurs when an application continues to use a memory pointer after the memory has been deallocated or freed. In this context, the flaw resides in the handling of Wasm object lifecycles.\nThe vulnerability allows an attacker to potentially execute arbitrary code within the context of the browser process if the memory is successfully reallocated with attacker-controlled data prior to the subsequent access.\nThis impacts Firefox versions prior to 157. The risk implication is high, as exploitation can lead to a full browser compromise, bypass of sandbox protections, or remote code execution (RCE).\nExploitation typically requires a user to navigate to a malicious web page hosting specially crafted WebAssembly code designed to trigger the lifecycle mismanagement.\nNo authentication is required to trigger this vulnerability, making it a critical threat to end-users.",
  "technicalDetails": "The vulnerability originates in the WebAssembly engine's memory management logic during the compilation or instantiation phase of Wasm modules. A use-after-free state is induced when an internal reference to a Wasm-related object is maintained after the underlying memory backing that object has been explicitly freed by the garbage collector or the module lifecycle manager.\nIn the Firefox JavaScript engine (SpiderMonkey), the WebAssembly component handles complex object lifecycles involving compilation, machine code generation, and memory mapping. The flaw indicates a race condition or an incorrect reference counting mechanism where a pointer remains active in a dangling state while the object it points to is no longer valid.\nThe exploitation flow proceeds as follows: First, the attacker triggers the instantiation of a malicious WebAssembly module. During this process, the attacker employs heap grooming techniques to manipulate the browser's heap layout. This is essential to ensure that the memory location previously occupied by the freed object is reallocated with malicious data or a controlled object structure that mimics the original state.\nSecond, by triggering the specific code path that leads to the dangling pointer, the engine attempts to access the memory block again. Because the memory has been reallocated, the engine operates on data provided by the attacker under the assumption that it is a valid Wasm object.\nThird, the attacker leverages this primitive to achieve 'Type Confusion' or arbitrary memory read/write. By manipulating the internal pointers or metadata of the reallocated object, an attacker can influence the execution flow of the JavaScript engine, eventually hijacking the control flow of the browser process.\nThe impact is significant because the browser operates with the permissions of the user. Successful exploitation bypasses standard mitigations, allowing for arbitrary code execution, which can be used to deploy malware, exfiltrate sensitive user data, or conduct further lateral movement within the system.\nThis vulnerability affects all Firefox versions prior to 157. It does not require local access, as the WebAssembly engine is exposed to web content through standard browser APIs, enabling remote exploitation via malicious JavaScript execution."
}