Description

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-01T13:20:05.933Z",
  "pubdate": "2026-09-01T13:20:05.933Z",
  "executiveSummary": "A critical memory corruption vulnerability has been identified within the Firefox DOM security component, specifically involving a use-after-free (UAF) flaw. This vulnerability enables a sandbox escape, allowing an attacker to bypass the browser's security boundary and execute arbitrary code with the privileges of the content process.\nThe vulnerability affects Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. By triggering this memory corruption, an attacker can manipulate objects that have been prematurely deallocated, leading to unauthorized memory access and potential control flow hijacking.\nThe risk implication is high, as successful exploitation facilitates sandbox escape, which is a foundational requirement for more complex browser-based attack chains. Attackers with the ability to influence DOM state, such as through malicious web content, can potentially elevate their access beyond the restricted browser environment. Authentication is not required, as the vector is typically triggered via remote web navigation or interactive web content exploitation. Immediate patching to the designated versions is required to neutralize this risk.",
  "technicalDetails": "The vulnerability originates from an improper management of object lifecycles within the Document Object Model (DOM) security subsystem. A use-after-free (UAF) condition occurs when the application fails to adequately clear references to a memory object after it has been freed, or when multiple concurrent operations contend for a resource that is subject to deletion.\nIn this context, the DOM component interacts with objects that remain reachable by the engine despite the memory having been reclaimed by the heap allocator. When the browser engine attempts to access this 'dangling' pointer, it interacts with memory that may have been repurposed for other data structures or executable code, depending on the heap layout at the time of the event.\nThe attack flow generally follows a multi-stage process. First, an attacker induces the browser to allocate a specific object within the DOM. Through crafted JavaScript, the attacker triggers a sequence of events—such as complex DOM tree mutations or asynchronous event handlers—that force the engine to release the underlying memory associated with that object while concurrently maintaining a reference to it in another part of the engine's internal structure.\nFollowing the deallocation, the attacker performs heap grooming or memory spraying to occupy the freed memory slot with controlled data. This effectively 'replaces' the legitimate object with attacker-controlled data. When the browser subsequently dereferences the dangling pointer to perform a routine security check or data retrieval, it inadvertently executes code or processes data provided by the attacker.\nBecause the vulnerability occurs within the security component responsible for enforcing sandbox boundaries, the successful exploitation of this UAF allows the malicious payload to bypass the sandbox's restrictions. By hijacking the instruction pointer or corrupting function pointers during the UAF window, the attacker can redirect execution to a return-oriented programming (ROP) chain or shellcode, thereby achieving code execution within the context of the browser process. This capability undermines the browser's compartmentalization, effectively allowing the attacker to break out of the content sandbox and gain higher levels of control over the browser's execution state.\nThis vulnerability is particularly potent because it does not require prior authentication or elevated privileges. The exploitation is solely dependent on the attacker’s ability to influence the browser to process malicious content, which is a primary attack vector in modern web exploitation."
}