Description

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-01T13:20:06.290Z",
  "pubdate": "2026-09-01T13:20:06.290Z",
  "executiveSummary": "This vulnerability is identified as a Use-After-Free (UAF) flaw residing within the DOM: Core & HTML components of the Mozilla Firefox browser. A Use-After-Free condition occurs when a program continues to use a pointer after the memory area it references has been deallocated, leading to undefined behavior.\nThe flaw affects Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2. If successfully exploited, this memory corruption vulnerability can allow a remote attacker to execute arbitrary code within the context of the browser process or cause a denial-of-service condition through application crashes.\nThe vulnerability typically requires the attacker to entice a user to visit a malicious website or interact with crafted web content. The implications are severe, as arbitrary code execution could lead to data theft, cross-site scripting (XSS) bypasses, or the installation of malicious software on the victim's host system. Given the nature of DOM-based memory management, this vulnerability represents a high-risk entry point for exploitation that bypasses standard browser security sandboxing mechanisms if primitive control over the freed memory object is achieved.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of object lifecycles within the DOM: Core and HTML components. In a Use-After-Free scenario, an object (e.g., an HTML element or a DOM node) is freed from memory while a dangling pointer to that memory location remains active in the application's address space. If the browser subsequently attempts to access, modify, or execute methods on the memory reference through the dangling pointer, it interacts with memory that may have already been reclaimed by the system allocator or reassigned to a different object.\nThe exploitation flow generally follows a specific sequence: First, the attacker triggers the premature destruction of a targeted object. This is often achieved through sophisticated DOM manipulation, such as complex event handling, synchronous script execution, or specific garbage collection (GC) triggers that cause the browser to release the underlying C++ object associated with a DOM element. Second, the attacker performs heap spraying or memory grooming to place controlled data—often representing a fake object or a pointer chain—into the memory address that was recently deallocated.\nOnce the attacker successfully replaces the contents of the freed memory, the third phase involves the triggering of the dangling pointer access. When the browser invokes a virtual method or accesses a property via the stale pointer, it inadvertently executes code or references data provided by the attacker. In the context of browser internals, this frequently manifests as an attacker-controlled virtual function table (vtable) pointer overwrite. By diverting the vtable pointer to a controlled location, the attacker redirects execution flow to a ROP (Return-Oriented Programming) chain or shellcode, effectively bypassing Data Execution Prevention (DEP) and Control Flow Guard (CFG) mechanisms.\nBecause this vulnerability exists within the DOM components, it is accessible via standard web content. There are no special authentication or privilege requirements to trigger the flaw; simply rendering a crafted HTML page is sufficient. Post-exploitation, the attacker gains the ability to execute arbitrary code within the browser process, which may then be used to pivot into further system compromise or facilitate unauthorized access to local file storage and sensitive session data. The complexity of modern browser memory management, specifically regarding the interaction between the JavaScript garbage collector and the DOM C++ objects, makes the tracking of object references highly prone to these types of synchronization errors."
}