Description

Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T13:20:06.160Z",
  "pubdate": "2026-09-01T13:20:06.160Z",
  "executiveSummary": "A critical use-after-free vulnerability exists within the WebGPU component of the Firefox browser engine. This memory safety flaw allows an attacker to trigger undefined behavior in the graphics subsystem, potentially leading to unauthorized privilege escalation. The vulnerability affects Firefox version 155 and Firefox ESR 153.2.\nThe vulnerability resides in the complex memory management lifecycle of WebGPU resources. By manipulating the object lifecycle, a remote attacker could achieve arbitrary code execution within the context of the browser process. Successful exploitation allows for a transition from a constrained sandbox environment to higher-privileged execution, depending on the process isolation configuration. Due to the nature of use-after-free bugs in browser graphics pipelines, the risk is classified as critical, as it bypasses standard security controls. Exploitation typically requires the victim to visit a malicious website hosting crafted WebGPU shaders or API calls designed to trigger the invalid memory reference. No authentication is required for remote exploitation, making this a significant threat to user system integrity.",
  "technicalDetails": "The vulnerability is identified as a use-after-free (UAF) condition within the Graphics: WebGPU component of Firefox. WebGPU is a high-performance graphics API that interfaces directly with underlying hardware drivers, requiring meticulous memory management to maintain process isolation. The vulnerability manifests when the browser's graphics engine fails to correctly track the reference counting or lifecycle of a WebGPU object (such as a buffer, texture, or command encoder) after it has been explicitly released or garbage collected.\nThe attack flow begins when an attacker provides malicious input, likely through a crafted WebGPU shader or a sequence of API calls that force the browser to retain a dangling pointer to a memory region that has already been deallocated. When the browser later attempts to access this memory region, the application inadvertently references reclaimed heap memory. If an attacker can successfully perform 'heap spraying' or coordinate memory allocation patterns, they can replace the original object with data controlled by the attacker.\nUpon triggering the read or write operation on the dangling pointer, the browser executes instructions based on the attacker-controlled data. In the context of the WebGPU subsystem, this allows the attacker to corrupt internal browser structures or redirect the control flow. By overwriting function pointers or object vtables, the attacker achieves arbitrary code execution. Because WebGPU operations are often processed in a way that interacts closely with the GPU process and the main browser process, this UAF serves as a vehicle for privilege escalation, permitting the attacker to escape the web content sandbox and gain the execution permissions of the browser process.\nThe technical root cause involves a race condition or a logic flaw in the resource synchronization logic within the WebGPU implementation. The vulnerable component is the WebGPU Graphics subsystem. This flaw affects Firefox 155 and Firefox ESR 153.2. Exploitation does not require prior authentication or specialized local access; however, it depends on the ability of the attacker to influence the heap state through JavaScript and WebGPU API interactions. Once control flow is hijacked, the payload typically facilitates further exploitation of the host system, potentially resulting in complete compromise of the browser environment."
}