Executive brief
Firefox's JavaScript garbage collection engine contains a use-after-free vulnerability that could allow an attacker to exploit memory safety issues through malicious scripts. An attacker could leverage this flaw to achieve code execution or bypass security protections by crafting specially designed web content.
Technical details
This is a use-after-free vulnerability in the JavaScript garbage collector (GC) component, a memory safety issue where freed memory is accessed after deallocation. The vulnerability is triggered through JavaScript execution, likely requiring the attacker to deliver malicious script content to the victim (via a website or similar vector). No authentication is required; a user simply needs to visit a malicious web page or open a crafted document. An attacker can exploit this to achieve memory corruption, potentially leading to code execution or privilege escalation. The vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
Affected products
- Mozilla Firefox before 155
- Mozilla Firefox ESR before 153.2
- Mozilla Thunderbird before 155
- Mozilla Thunderbird ESR before 153.2
Timeline
- 2026-09-01: disclosed: Vulnerability disclosed via Mozilla Security Advisory MFSA2026-82
- 2026-09-01: patched: Fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2