Description

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-01T13:20:06.040Z",
  "pubdate": "2026-09-01T13:20:06.040Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Audio/Video component of Firefox. This memory corruption flaw occurs when the application continues to reference a memory address after it has been deallocated, potentially leading to arbitrary code execution or unexpected application termination. The vulnerability affects Firefox version 155, Firefox ESR 140.15, and Firefox ESR 153.2.\nThis type of memory safety violation allows an attacker to manipulate the heap state through crafted media content. Successful exploitation could grant an attacker the ability to execute arbitrary code with the privileges of the current user, compromising the integrity and confidentiality of the host system. The flaw does not explicitly require user authentication for exploitation, though it typically necessitates that a user processes maliciously crafted media data within the browser environment. Organizations should prioritize updating to the specified patched versions to mitigate the risk of exploitation.",
  "technicalDetails": "The vulnerability is classified as a use-after-free (UAF) condition residing within the Audio/Video component of the Firefox browser engine. This flaw manifests due to improper object lifecycle management during the processing of media streams. In the context of browser multimedia handling, objects such as buffers, decoders, or media pipeline controllers are dynamically allocated on the heap to manage streaming data. A use-after-free occurs when a pointer to such an object remains valid and accessible even after the underlying memory has been freed by the memory allocator, typically during a transition in the media playback state or a document cleanup operation.\nThe attack flow generally involves an attacker providing a specially crafted media file or stream that triggers a specific sequence of operations. This sequence forces the Audio/Video component to free a resource that is subsequently accessed by a dangling pointer. By manipulating the heap layout—often through 'heap spraying' or other memory grooming techniques—an attacker can reclaim the freed memory region and populate it with controlled data. When the application logic subsequently performs an operation using the dangling pointer, it effectively executes code or manipulates data structures according to the attacker's injected payload.\nThe technical impact of this vulnerability is significant, as successful exploitation bypasses standard memory protections to facilitate arbitrary code execution (ACE) within the browser's sandbox. Given the complexity of the Audio/Video component, the exploitation process likely requires precise control over the browser's event loop or media rendering timing. The vulnerability affects Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2. As the component is integrated into the core media rendering pipeline, any web page capable of invoking these Audio/Video functions can potentially trigger the flaw, making it highly dangerous for users navigating to untrusted content. No specific authentication is required, as the browser processes incoming media automatically upon navigation or content interaction.\nPost-exploitation, an attacker may achieve execution context escalation or sandbox escape depending on the browser's underlying process architecture and existing security controls. The primary vector involves bypassing internal reference counting or object ownership tracking mechanisms within the media subsystem, leading to a race condition or an inconsistent state that results in the reuse of deallocated heap memory."
}