Description

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:46.650Z",
  "pubdate": "2026-09-29T13:17:46.650Z",
  "executiveSummary": "A use-after-free (UAF) vulnerability has been identified within the CSS Parsing and Computation component of Mozilla Firefox. This memory corruption flaw allows a remote attacker to trigger a heap-based memory management error, potentially leading to arbitrary code execution within the context of the browser process.\nThe vulnerability affects Firefox ESR 153.4 and Firefox 157. Successful exploitation requires the user to process specially crafted web content, such as a malicious website, causing the browser to interact with a deallocated object in memory.\nThe impact includes application crashes, information disclosure, and the potential for remote code execution (RCE). Because this flaw occurs within the browser's CSS engine, it does not require prior authentication or elevated privileges. However, the attacker must entice a user to navigate to a malicious URL or interact with compromised content. Given the severity of UAF vulnerabilities, this issue represents a significant risk to client-side system integrity and user data confidentiality, necessitating immediate patching of affected browser versions.",
  "technicalDetails": "The vulnerability resides in the CSS Parsing and Computation engine, specifically involving the lifecycle management of objects during complex style rule resolution. A use-after-free occurs when an application continues to use a pointer to a memory location after the corresponding object has been deallocated or freed, often due to an improper reference count or an incorrect state transition within the CSS processing state machine.\nThe root cause is a failure in the memory reclamation logic during the parsing of malformed or specifically crafted CSS rule-sets. When the CSS engine parses specific object structures, certain triggers—such as style recalculations or dynamic modifications to the Document Object Model (DOM) during the parsing phase—may cause an object to be freed prematurely while the parser still retains a pointer to it. When the parser subsequently accesses this dangling pointer, the engine performs operations on stale memory.\nThe attack flow begins when an attacker directs a user to a malicious webpage containing a crafted style sheet. As the browser’s CSS engine attempts to parse and compute styles for the document, it triggers the vulnerable code path. If an attacker can successfully control the contents of the freed memory block before the dangling pointer is accessed—a technique commonly known as 'heap spraying' or 'heap grooming'—they can force the browser to execute arbitrary instructions contained in the attacker-controlled data.\nBy manipulating the heap to place a malicious object where the previously freed CSS object resided, the attacker achieves control over virtual function tables (vtable) or other sensitive pointers. This typically results in a transition of control flow to an attacker-specified memory address, enabling the execution of shellcode or arbitrary payloads.\nThe vulnerability affects Firefox versions prior to Firefox 157 and Firefox ESR 153.4. The scope of the attack is limited to the browser’s sandbox, though additional primitives (such as an information leak) could potentially be combined with this UAF to bypass sandbox restrictions and achieve full system-level command execution. No authentication is required for this attack, and it is natively exploitable over a standard network connection via malicious web content."
}