Description

Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:48.350Z",
  "pubdate": "2026-09-29T13:17:48.350Z",
  "executiveSummary": "A critical use-after-free (UAF) vulnerability exists within the Firefox DOM: UI Events & Focus Handling component. This security flaw stems from improper memory management during the processing of focus-related events, potentially allowing an attacker to manipulate object lifecycles.\nSuccessful exploitation of this vulnerability could lead to arbitrary code execution, unauthorized data access, or application instability. The issue affects Firefox ESR 153.4 and earlier, as well as Firefox 157 and earlier versions.\nThe vulnerability is exploitable via a malicious web page, requiring the user to interact with or navigate to content that triggers the flawed event handling sequence. As a memory corruption vulnerability, it poses a significant risk to confidentiality, integrity, and availability, enabling attackers to bypass standard sandbox protections if combined with secondary primitives.",
  "technicalDetails": "The root cause of this vulnerability is a use-after-free condition within the DOM UI events architecture, specifically triggered during focus state transitions. The component responsible for managing event dispatching for focus events fails to correctly maintain reference counts or validate the persistence of DOM nodes during the event propagation lifecycle.\nIn a typical attack flow, the adversary orchestrates a sequence of events—such as rapid focus changes or element removal—that triggers a call to a DOM object that has already been deallocated by the memory manager. Because the UI Events & Focus Handling component retains a stale pointer to the freed memory, it performs a dereference operation on a dangling pointer.\nThe exploitation process generally involves heap grooming to reallocate the freed memory block with attacker-controlled data. Once the attacker successfully populates the target memory slot with a crafted object, the subsequent use of the stale pointer allows for controlled execution flow hijacking. By overwriting function pointers or virtual method tables within the reallocated memory, an attacker can redirect execution to arbitrary code or gadgets, effectively achieving remote code execution (RCE) within the context of the browser process.\nThis vulnerability resides in the core DOM processing logic, which is exposed to any content loaded within the browser. No special authentication or elevated privileges are required for an attacker to initiate the attack; it is reachable through standard web page rendering. The scope of the impact depends on the browser's current security architecture and the ability of the attacker to bypass exploit mitigations like ASLR or DEP, which are typically addressed via this specific patch. The defect specifically impacts the interaction between DOM event listeners and the underlying focus state engine, representing a failure in ensuring object lifetime safety during event propagation."
}