Description

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-29T13:17:48.453Z",
  "pubdate": "2026-09-29T13:17:48.453Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified within the Graphics: Canvas2D component of the Firefox browser.\nThis memory corruption flaw occurs when the application continues to reference a memory address after it has been deallocated, potentially leading to arbitrary code execution or unexpected application termination.\nThe vulnerability affects multiple Firefox ESR branches, specifically versions 153.4, 115.42, and 140.17.\nAn attacker could potentially exploit this memory safety issue by crafting malicious web content that triggers the flawed state, leading to a crash or, in more severe scenarios, the hijacking of the browser's execution flow.\nGiven the nature of UAF vulnerabilities in graphics rendering engines, the potential for arbitrary code execution poses a significant risk to user data integrity and system confidentiality.\nSuccessful exploitation generally requires the target to visit a maliciously crafted webpage, highlighting the necessity for prompt browser updates to mitigate the risk of drive-by compromise.",
  "technicalDetails": "The vulnerability resides within the Graphics: Canvas2D component, which is responsible for rendering 2D graphics via the HTML5 Canvas API.\nA Use-After-Free (UAF) condition is triggered when an object managed by the Canvas2D rendering pipeline is incorrectly deallocated while a persistent reference or pointer to that object remains active within the object's lifecycle management.\nIn typical browser architectures, the Canvas2D implementation maintains internal state objects representing drawing paths, canvases, or contexts. When these objects are improperly handled—specifically through asynchronous calls or race conditions during script execution—the memory allocator releases the heap space back to the system.\nSubsequent attempts to access or manipulate the dangling pointer permit the attacker to interact with memory that may have since been reallocated for other objects.\nThe attack flow generally involves the manipulation of JavaScript APIs that interface with the Canvas rendering context. By inducing specific state transitions, such as clearing a canvas or resetting a context while internal operations are pending, an attacker can coerce the Graphics component into a state where it references freed memory.\nUpon triggering this access, an attacker may use techniques like heap grooming or spraying to occupy the freed memory slot with controlled data. If the engine later uses the dangling pointer to perform a virtual function call, the attacker can redirect the program counter to an arbitrary location, effectively hijacking the browser process.\nThis vulnerability does not require authentication or elevated privileges, as it is exploitable via standard web interaction. The exploitability is contingent upon the browser's ability to render the malicious content in a context where the attacker can reliably influence heap memory layout.\nSuccessful exploitation allows for the execution of arbitrary machine code with the privileges of the content process sandbox. While the sandbox provides a layer of defense, post-exploitation impact often includes full control over the browser session, exfiltration of sensitive site data, or potential sandbox escape maneuvers leading to system-level persistence."
}