Description

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-29T13:17:45.073Z",
  "pubdate": "2026-09-29T13:17:45.073Z",
  "executiveSummary": "A critical use-after-free vulnerability exists within the Disability Access APIs component of the Firefox browser, enabling a sandbox escape.\nThis memory corruption flaw allows a remote attacker to gain unauthorized access to underlying system resources by bypassing the browser's security sandbox.\nThe vulnerability affects Firefox versions prior to 157 and Firefox ESR versions prior to 153.4.\nSuccessful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the content process, potentially escalating to full system compromise depending on the effectiveness of the sandbox confinement.\nThe flaw stems from improper memory management within the accessibility framework, where a dangling pointer is referenced after the associated object has been deallocated.\nThe risk is rated as high, as it facilitates a critical breach of the browser's isolation architecture, which is fundamental to protecting user data and operating system integrity.\nExploitation generally requires the victim to interact with specially crafted web content designed to trigger the use-after-free condition via malicious Disability Access API calls.\nUsers and administrators are advised to update to the patched versions immediately to mitigate the risk of arbitrary code execution and sandbox container breakout.",
  "technicalDetails": "The vulnerability is classified as a use-after-free (UAF) memory corruption issue located within the Disability Access APIs component of the Firefox browser.\nRoot Cause: The defect arises when the browser fails to properly manage the lifecycle of objects used by the accessibility layer. A specific object, intended for disability access functions, is prematurely freed while a dangling pointer remains active in memory. If an attacker can influence the heap allocation pattern or trigger subsequent operations that reference this pointer, they can redirect execution flow or manipulate data structures.\nAttack Flow: An attacker typically delivers a malicious payload through web content, such as a crafted HTML document or script, designed to interact with the Disability Access APIs. By triggering specific accessibility event sequences, the attacker forces the browser to deallocate a memory block while simultaneously maintaining a reference to it. When the application engine subsequently attempts to perform an operation on the now-freed memory address, the attacker’s injected data—placed in that freed memory location via heap spraying—is treated as a valid object or function pointer.\nExploitation Method: By controlling the data at the location of the freed object, an attacker can influence the program's control flow, potentially diverting the instruction pointer to a ROP (Return-Oriented Programming) chain or executing arbitrary shellcode. Because this vulnerability occurs within the browser's accessibility framework, it is particularly dangerous for escaping the content process sandbox. By compromising the memory of the accessibility bridge, the attacker can manipulate inter-process communication (IPC) primitives to bridge the gap between the isolated content process and the parent process.\nImpact: The successful execution of this exploit results in a sandbox escape. This allows an attacker to bypass the browser's mandatory access control mechanisms, gaining the ability to interact with the underlying OS or steal sensitive user data such as credentials, session tokens, or local files. The privilege level attained is equivalent to the browser process, which, if combined with other system-level vulnerabilities, could lead to full machine takeover.\nAffected Versions: Firefox before 157, Firefox ESR before 153.4. No authentication is required for remote exploitation, and the attack is reachable via standard web browsing activities, necessitating no prior user credentials."
}