Description

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:47.803Z",
  "pubdate": "2026-09-29T13:17:47.803Z",
  "executiveSummary": "This vulnerability is identified as a Use-After-Free (UAF) flaw within the Just-In-Time (JIT) compilation component of the Firefox JavaScript engine.\nThe vulnerability allows an unauthenticated, remote attacker to trigger memory corruption through specifically crafted JavaScript content, potentially leading to arbitrary code execution or a crash of the rendering process.\nThe flaw affects Firefox versions prior to 157 and Firefox ESR versions prior to 153.4.\nSuccessful exploitation requires the victim to visit a malicious website or interact with compromised web content.\nThe risk is critical, as browser-based JIT vulnerabilities are frequently leveraged to escape sandbox environments and achieve remote code execution (RCE) by manipulating memory objects after their lifecycle has terminated.\nUsers and administrators are strongly advised to update to the latest patched versions of Firefox to mitigate the risk of exploitation.",
  "technicalDetails": "The root cause of this vulnerability lies in the memory management logic within the JIT compiler, which incorrectly tracks the lifecycle of objects during the compilation or optimization phases.\nA Use-After-Free condition occurs when the JIT engine optimizes a block of code involving JavaScript objects, leading to a scenario where a pointer to a heap-allocated object remains active in the JIT-generated machine code after the memory associated with that object has been deallocated or garbage collected.\nThe attack flow typically begins with an attacker injecting malicious JavaScript intended to trigger specific optimization paths within the JIT compiler. By forcing the engine to speculate on type transitions or object shapes, an attacker can induce the engine to create a machine code sequence that retains a stale reference to a freed heap address.\nOnce the reference is dangling, the attacker must synchronize the memory allocator to reclaim the freed memory block with a controlled object or data structure (heap spraying). Subsequent execution of the stale pointer results in the use of this attacker-controlled data, enabling memory corruption.\nExploitation often involves leveraging this corruption to gain read/write primitives within the process memory space. By manipulating JavaScript objects (e.g., ArrayBuffer or TypedArrays), an attacker can bypass ASLR and DEP by overwriting object metadata or function pointers. This provides a mechanism for arbitrary code execution in the context of the user process.\nBecause the JIT component operates at high speed and high privilege relative to the content process, the vulnerability is highly attractive for sandbox escape payloads. There is no authentication requirement; the vulnerability is triggered entirely through the browser's interaction with the DOM and script execution engine.\nThe vulnerability manifests within the JIT pipeline's interaction with the underlying garbage collector, highlighting a breakdown in synchronization between the JIT-compiled IR (Intermediate Representation) and the heap management system."
}