Description

Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-18T13:17:34.927Z",
  "pubdate": "2026-08-18T13:17:34.927Z",
  "executiveSummary": "This security advisory details a critical vulnerability involving a race condition and subsequent use-after-free within the Graphics component of Mozilla Firefox.\nThe flaw allows untrusted threat actors to achieve arbitrary memory corruption, potentially leading to arbitrary code execution within the context of the affected application.\nAffected software products include Firefox, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1.\nThe risk implications are severe, as successful exploitation compromises the integrity, availability, and confidentiality of the host system.\nAttacker capabilities require the delivery of maliciously crafted content, typically via a compromised or malicious web page designed to trigger asynchronous event handling anomalies in the browser's rendering engine.\nExploitation requirements generally involve inducing specific timing conditions to trigger concurrent access to freed memory locations during graphics processing operations.",
  "technicalDetails": "The vulnerability is fundamentally rooted in improper concurrency management and synchronization within the Graphics component of the browser engine.\nSpecifically, a race condition manifests when multiple execution threads access shared memory resources without adequate locking mechanisms or thread synchronization primitives.\nWhen a rendering or display operation encounters an asynchronous state transition, one thread may release a graphics-related object while another thread concurrently attempts to read, write, or invoke methods upon the same deallocated memory address, resulting in a classic use-after-free condition.\nThe vulnerable component resides within the subsystem responsible for hardware-accelerated rendering and graphics pipeline management.\nAffected versions comprise Firefox prior to version 154, Firefox ESR 115 prior to 115.39, Firefox ESR 140 prior to 140.14, and Firefox ESR 153 prior to 153.1.\nThe attack flow typically initiates when a user navigates to a malicious webpage containing specialized HTML, CSS, or SVG elements engineered to stress the graphics processing pipeline and induce race conditions.\nUpon parsing and rendering the malicious content, the browser triggers concurrent asynchronous tasks that lead to the premature destruction of internal graphics objects.\nSubsequent access to the dangling pointer by the secondary thread corrupts the heap metadata or overwrites critical function pointers.\nAuthentication requirements are none, as the attack can be executed remotely via standard web browsing vectors.\nPrivilege requirements are minimal; the attacker requires no prior access to the underlying operating system, operating strictly within the unprivileged security sandbox of the browser renderer process.\nNetwork exposure is high, given that the attack vector relies on standard web protocols (HTTP/HTTPS) accessible via normal web browsing activity.\nPost-exploitation impact includes the potential bypassing of browser sandbox mitigations if chained with additional vulnerabilities, leading to arbitrary code execution on the underlying host operating system with the privileges of the user running the browser process."
}