Executive brief
A security vulnerability has been identified in the WebRTC component of Mozilla Firefox, which handles real-time audio and video communication. An attacker could exploit this flaw to potentially execute unauthorized code or crash the browser when a user visits a malicious website. This could lead to the theft of sensitive information or a complete compromise of the user's browsing session.
Technical details
A use-after-free vulnerability exists in the WebRTC: Audio/Video component of Mozilla Firefox. The flaw occurs when the browser attempts to access memory that has already been deallocated during the processing of audio or video streams. An attacker can exploit this by enticing a user to visit a specially crafted webpage, triggering the memory corruption. This can result in a stable browser crash (Denial of Service) or potentially arbitrary code execution within the context of the browser process. The vulnerability is addressed in Firefox 153 and Firefox ESR 140.13.
Affected products
- Mozilla Firefox < 153
- Mozilla Firefox ESR < 140.13
Timeline
- 2026-07-21: disclosed
- 2026-07-21: patched