Description

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-01T13:20:05.817Z",
  "pubdate": "2026-09-01T13:20:05.817Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) flaw residing within the Audio/Video component of the Mozilla Firefox browser. A use-after-free condition occurs when an application continues to use a memory pointer after the memory it references has been explicitly deallocated or freed, leading to undefined behavior.\nIf successfully exploited, this memory corruption vulnerability can allow a remote attacker to trigger a crash or, more critically, execute arbitrary code within the context of the browser's process. The vulnerability affects Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.\nThe risk implication is significant as successful exploitation can lead to a complete compromise of the user's browser session, potentially allowing unauthorized access to sensitive data or the installation of malicious software on the host system. Exploitation generally requires the victim to visit a maliciously crafted website or interact with attacker-controlled content processed by the browser's audio/video rendering engine. No authentication is typically required for a remote attacker to attempt exploitation.",
  "technicalDetails": "The root cause of this vulnerability is improper memory management within the Audio/Video component of Firefox. Specifically, the component fails to properly manage the lifecycle of objects related to media processing. A dangling pointer is created when an object involved in media decoding or playback is deallocated, yet a reference to that memory address persists and is subsequently accessed by the application logic.\nIn a typical use-after-free attack flow involving media components, the exploitation occurs through a series of carefully orchestrated steps. First, the attacker provides a specially crafted media file or stream that forces the browser's audio/video engine to allocate specific objects in memory. Through manipulation of the media data—often involving complex container formats or malformed stream parameters—the attacker triggers a condition where the engine prematurely releases the memory associated with these objects while still maintaining references to them elsewhere in the application state.\nOnce the memory has been freed, the attacker seeks to influence the heap layout. This is commonly achieved through heap spraying or other memory grooming techniques, whereby the attacker attempts to allocate new objects of a similar size to the original, deallocated object. The goal is to place attacker-controlled data into the specific memory location previously occupied by the freed object. When the application subsequently attempts to perform an operation using the original, now-dangling pointer, it instead interacts with the data planted by the attacker.\nIf the application logic uses this dereferenced pointer to call a function or perform a memory write, the attacker gains control over the execution flow. By overwriting virtual method tables (vtable) or function pointers, the attacker can redirect the program's execution to arbitrary code, such as a ROP (Return-Oriented Programming) chain, which effectively bypasses common security mitigations like Data Execution Prevention (DEP).\nGiven that this vulnerability exists within the media processing component, the attack surface is exposed whenever the browser parses media content from untrusted sources. This does not require local access or authentication. Post-exploitation, an attacker can achieve arbitrary code execution with the privileges of the Firefox content process, allowing for the potential exfiltration of sensitive information, such as cookies, saved passwords, or local files, depending on the browser's sandbox implementation and the presence of additional vulnerabilities to facilitate a sandbox escape."
}