Executive brief
A vulnerability exists in the Web Audio component of the Firefox web browser, which handles audio processing for websites. An attacker could potentially exploit incorrect boundary checks to cause a crash or execute unauthorized actions when a user visits a malicious website. This could lead to a compromise of the user's browser session or data.
Technical details
The vulnerability is classified as an 'incorrect boundary conditions' issue within the Web Audio component of Mozilla Firefox. While specific technical details are restricted in the associated bug report (Bug 2038465), this class of vulnerability typically involves out-of-bounds reads or writes during audio processing. An attacker could exploit this by enticing a user to visit a specially crafted webpage that utilizes the Web Audio API. Successful exploitation could lead to memory corruption, potentially allowing for arbitrary code execution within the context of the browser process. The issue is resolved in Firefox 152 and Firefox ESR 140.12.
Affected products
- Mozilla Firefox < 152
- Mozilla Firefox ESR < 140.12
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory
- 2026-06-16: patched