Description

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-01T13:20:05.713Z",
  "pubdate": "2026-09-01T13:20:05.713Z",
  "executiveSummary": "This vulnerability involves a use-after-free (UAF) flaw located within the Navigation component of the Mozilla Firefox Document Object Model (DOM) implementation.\nThe flaw permits a sandbox escape, a critical security failure where an attacker can bypass the browser's isolation boundaries to execute arbitrary code within the context of the host operating system or the browser process.\nThe vulnerability affects Firefox version 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.\nA successful exploit grants an attacker the capability to achieve remote code execution, potentially leading to total system compromise, data theft, or malware installation.\nExploitation generally requires the victim to interact with malicious web content, such as navigating to a specially crafted URI or interacting with a compromised webpage that triggers the specific DOM navigation sequence.\nGiven the nature of use-after-free vulnerabilities, the risk is severe, as these flaws are frequently weaponized in targeted browser-based attacks to circumvent modern sandboxing technologies.",
  "technicalDetails": "The vulnerability is rooted in a memory management error within the Firefox DOM Navigation component, specifically occurring during the lifecycle management of objects involved in page navigation processes.\nA use-after-free occurs when the browser engine continues to utilize a pointer to a memory location after the object at that location has been deallocated or freed.\nIn the context of the Navigation component, a race condition or improper state tracking allows an attacker to influence the garbage collection or deallocation process of a DOM object while a reference to that object remains active in the execution queue.\nThe attack flow typically begins when a threat actor triggers a specific sequence of DOM events that forces the navigation component to handle a target object in a state where it is scheduled for deletion.\nBy manipulating the heap layout—often through techniques such as heap spraying or precise allocation control—the attacker can replace the freed object with malicious data.\nWhen the navigation logic subsequently attempts to access the stale pointer, it inadvertently interacts with the attacker-controlled memory instead of the expected object structure.\nThis invalid access provides a primitive for memory corruption, allowing the attacker to hijack the instruction pointer or corrupt function pointers within the browser's process.\nOnce control flow is redirected, the attacker can execute arbitrary shellcode or perform a Return-Oriented Programming (ROP) chain to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).\nBecause this vulnerability occurs within a component capable of affecting browser process state, successful exploitation allows for a sandbox escape, effectively elevating the attacker's context from the restricted renderer process to the higher-privilege parent process.\nThis elevates the impact significantly, as the attacker is no longer constrained by the browser's security sandbox, allowing for unauthorized access to local files, persistent system manipulation, or further lateral movement within the network.\nThe vulnerability does not require authentication from the victim, and it is reachable through standard network exposure provided the user browses to the malicious payload.\nThe severity is compounded by the fact that DOM-based navigation is a fundamental browser operation, making the attack surface broad for any user navigating web content."
}