Executive brief
Firefox's security sandbox, which isolates web content from the browser and system, contains a memory corruption flaw in its DOM (Document Object Model) handling. An attacker could exploit this vulnerability to escape the sandbox and potentially gain unauthorized access to the browser process, system data, or execute malicious code with elevated privileges.
Technical details
This vulnerability is a use-after-free flaw in the DOM: Security component of Firefox. The defect allows an attacker to reference memory that has been freed, potentially leading to memory corruption. The vulnerability enables sandbox escape, allowing code running in a sandboxed context to break out and access resources outside the sandbox boundary. The attack likely requires user interaction or the ability to run code within the browser (e.g., malicious JavaScript on a visited website). Mozilla patched this issue in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2, as well as in Thunderbird 155, 140.15, and 153.2.
Affected products
- Mozilla Firefox before 155
- Mozilla Firefox ESR 115.x before 115.40, 140.x before 140.15, 153.x before 153.2
- Mozilla Thunderbird before 155, 140.x before 140.15, 153.x before 153.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Patched in Firefox 155, Firefox ESR 115.40, 140.15, 153.2, Thunderbird 155, 140.15, 153.2