Executive brief
A memory management vulnerability was identified in the WebAssembly component of the Mozilla Firefox web browser. An attacker could potentially exploit this flaw to cause a browser crash or execute unauthorized code when a user visits a malicious website. This could lead to the theft of sensitive information or a compromise of the user's system.
Technical details
A use-after-free (UAF) vulnerability exists in the JavaScript: WebAssembly component of Mozilla Firefox. The flaw is triggered when the engine attempts to access memory that has already been deallocated, often due to improper pointer management (CWE-416/CWE-825). An attacker can exploit this by enticing a user to process specially crafted WebAssembly content, potentially leading to a heap-based buffer overflow or arbitrary code execution within the context of the browser process. The vulnerability is resolved in Firefox version 150.0.3.
Affected products
- Mozilla Firefox before 150.0.3
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-05-12: patched: Fixed in Firefox 150.0.3