Description

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-29T13:17:46.230Z",
  "pubdate": "2026-09-29T13:17:46.230Z",
  "executiveSummary": "This vulnerability is a critical use-after-free (UAF) memory corruption flaw residing within the Core and HTML components of the Mozilla Firefox engine.\nA use-after-free occurs when an application continues to use a memory pointer after it has been explicitly deallocated, allowing an attacker to manipulate the object's lifecycle.\nSuccessful exploitation of this vulnerability facilitates a sandbox escape, enabling an attacker to break out of the restricted content process and achieve arbitrary code execution within the context of the host operating system or the parent process.\nThe vulnerability affects Firefox, Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.\nThe risk is categorized as high, as it allows for bypasses of browser-based security boundaries, potentially leading to full system compromise if chained with secondary exploits.\nExploitation typically requires the victim to visit a maliciously crafted website designed to trigger the specific state transition that leads to the dangling pointer reference.\nThere are no explicit authentication requirements, as the vulnerability is triggered through standard browser interaction with web content.",
  "technicalDetails": "The root cause of this vulnerability lies in the memory management logic within the Core and HTML DOM (Document Object Model) handling components. Use-after-free conditions typically emerge in these browser subsystems when a race condition or an improper object lifecycle state occurs, specifically during the layout or rendering of complex HTML elements.\nIn this instance, an attacker can manipulate DOM tree structures to trigger a premature deallocation of an object while a stale pointer to that same memory region remains active in the engine's object registry or reference counter. When the browser subsequently attempts to access or perform operations on this dangling pointer, the memory may have been reallocated or re-initialized with attacker-controlled data.\nThe attack flow generally involves three distinct phases: heap grooming, trigger, and payload execution. First, the attacker performs heap spraying or memory grooming to place controlled data into the heap segment where the target object previously resided. Second, the attacker triggers the vulnerability by inducing a specific state change—such as modifying a DOM element's parent-child relationship or executing a script that forces a garbage collection cycle—while retaining a reference to the freed object.\nUpon accessing the dangling pointer, the browser engine executes code or jumps to an address based on the data now occupying the 'freed' memory. Because this occurs within the browser's sandbox-isolated process, the exploitation path focuses on overwriting function pointers or virtual method tables (vtable) within the hijacked object. This redirection allows the attacker to hijack the execution flow (Control-Flow Integrity bypass) and escalate privileges.\nA sandbox escape is achieved by pivoting the hijacked execution from the isolated content process into the privileged parent process. Once the attacker breaks the sandbox, they can perform arbitrary actions with the privileges of the Firefox application, such as reading local file systems, installing persistent malicious payloads, or interacting with operating system APIs that are normally restricted. The affected versions include Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. The impact is significant as it negates the primary security boundary provided by modern browser process isolation architectures."
}