Description

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-01T13:20:05.607Z",
  "pubdate": "2026-09-01T13:20:05.607Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified within the JavaScript Garbage Collection (GC) component of the Firefox browser engine.\nThis memory corruption flaw occurs when the engine improperly handles object lifecycles during garbage collection, potentially leaving dangling pointers to memory that has already been deallocated.\nThe vulnerability affects Firefox versions prior to 155 and Firefox ESR versions prior to 153.2.\nSuccessful exploitation of this flaw allows an unauthenticated, remote attacker to trigger arbitrary code execution in the context of the browser process.\nBy coercing the browser to access a deallocated memory region through a maliciously crafted web page, an attacker can manipulate heap structures to achieve memory corruption, leading to a compromise of the user's system integrity.\nThe risk is severe as it facilitates cross-site scripting bypasses, sandboxing escapes, or remote code execution (RCE) without requiring user interaction beyond visiting a compromised site.\nUsers are strongly advised to update to the latest versions to neutralize the exploitation vector.",
  "technicalDetails": "The vulnerability resides in the JavaScript engine's Garbage Collection (GC) component, which is responsible for automatic memory management by reclaiming memory occupied by objects that are no longer reachable by the application.\nA Use-After-Free (UAF) condition is triggered when the GC mechanism incorrectly identifies an object as unreachable or undergoes a race condition during the mark-and-sweep phase, leading to the premature freeing of memory that remains referenced elsewhere in the engine.\nIn the context of the Firefox JS engine, this typically occurs when a GC trigger occurs while a specific object is in an inconsistent state or during the transition between different object layouts.\nThe attack flow begins when an attacker provides a specially crafted script that manipulates the JavaScript heap, forcing the GC to perform a collection cycle at an opportune moment. By inducing a state where an object is freed while a pointer to it is preserved, the attacker creates a 'use-after-free' primitive.\nOnce the memory has been deallocated, the attacker attempts to perform a heap spray or object allocation to fill the vacated memory region with controlled data. When the JS engine subsequently attempts to access the stale pointer, it operates on the attacker-controlled memory instead of the original object.\nThis type of memory corruption allows for the redirection of control flow. By overwriting function pointers or object vtables within the heap, an attacker can hijack the program counter, leading to arbitrary code execution within the browser's privilege level.\nThis vulnerability is particularly dangerous because it bypasses conventional browser security protections, such as Address Space Layout Randomization (ASLR), if an attacker can discover an information leak to determine memory offsets, or if they rely on heap-shaping techniques to achieve a predictable memory state.\nAffected components include the core memory management routines of the SpiderMonkey JS engine. The issue is present in versions of Firefox prior to 155 and Firefox ESR versions prior to 153.2, necessitating an update to the patched memory management logic provided in these releases."
}