Description

Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 157.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-29T13:17:45.600Z",
  "pubdate": "2026-09-29T13:17:45.600Z",
  "executiveSummary": "This vulnerability involves a race condition leading to a use-after-free (UAF) memory corruption flaw within the Audio/Video component of Firefox. The defect poses a critical security risk as it potentially allows a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service state on affected systems.\nThe vulnerability exists in Firefox versions prior to 157. Successful exploitation requires the attacker to influence the timing of concurrent processes, specifically targeting the synchronization between object lifecycle management and media stream handling. If successful, the attacker can leverage the UAF condition to manipulate the application's memory heap, leading to control flow hijacking or unauthorized memory access. This flaw represents a significant risk to user confidentiality, integrity, and availability, particularly when browsing untrusted content capable of triggering complex asynchronous media operations.",
  "technicalDetails": "The vulnerability originates from inadequate synchronization mechanisms within the Firefox Audio/Video processing engine, specifically during the handling of concurrent media object references. The race condition occurs when multiple threads attempt to access or release media resources simultaneously without proper locking or atomic operations. In a typical UAF scenario within this component, an object is freed by one thread while another thread maintains a stale pointer to the same memory region.\nThe exploitation flow begins with an attacker triggering the race condition by manipulating media events, such as rapid toggling of play/pause states or concurrent stream resource updates. The attacker must carefully time the execution of operations to ensure that the memory allocator reclaims the freed object and potentially replaces it with attacker-controlled data. When the stale pointer is later dereferenced, the engine inadvertently performs operations on the attacker-supplied data, which can lead to type confusion or direct execution of malicious payloads if the memory address points to an attacker-controlled function pointer or vtable.\nThe Audio/Video component acts as the vulnerable surface, where complex state machines govern the lifecycle of buffers and media pointers. The lack of robust thread synchronization in this sub-component allows for a temporal window where a pointer becomes invalid. An attacker can exploit this window by deploying a payload designed to stabilize the heap grooming process, ensuring that the freed memory block is reallocated with malicious data before the next use occurs.\nPost-exploitation impact includes the potential for arbitrary code execution with the privileges of the Firefox content process. By gaining control of the execution flow via the UAF, an attacker can bypass modern browser protections like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) if they can leak pointers or utilize sophisticated heap spraying techniques. The vulnerability does not require authentication and can be triggered remotely via malicious web content, significantly increasing the potential attack surface."
}