EUVD-2026-88926
GHSA-38rp-mx4j-w7p4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted malicious web page
-
DeliveryLure victim to load page
-
ExploitTrigger DOM use-after-free
-
ExecutionCorrupt reused heap memory
-
ImpactHijack control flow / execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires user interaction (UI:R): the victim must load attacker-controlled web content in a vulnerable Firefox build. Affected versions are those prior to Firefox 157, ESR 153.4, ESR 140.17, and ESR 115.42; systems on those patched releases are not exploitable. No authentication or special server-side configuration is needed - exploitation targets the default browser rendering path - but success depends on the attacker reliably grooming the heap to leverage the freed DOM object, and modern Firefox sandboxing/mitigations raise the bar for full code execution beyond a crash. |
| Impact | The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated use-after-free requiring only that a victim load attacker-controlled web content - a classic drive-by browser exploitation profile. As a CWE-416 UAF in the DOM: Core & HTML engine, this is memory corruption with RCE-class potential, not a mere info leak. However, no EPSS score, no CISA KEV entry, and no public POC were provided, so there is no signal of active or imminent exploitation. Weaponizing modern Firefox UAFs is non-trivial (heap grooming plus sandbox/exploit-mitigation bypass), which tempers real-world urgency relative to the raw 8.8. Net: a genuinely high-severity flaw in a ubiquitous product that warrants prompt patching, but current evidence points to no confirmed exploitation - priority is driven by product footprint and impact potential, not by observed attacks. No conflicting signals in the CVSS vector vs. description; both agree on remote, user-interaction-gated client-side exploitation. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects malicious content into a site/ad the victim visits) that manipulates DOM objects to trigger the use-after-free in Firefox's Core & HTML engine. When the victim browses to the page, the freed-then-reused memory is corrupted to hijack control flow, potentially leading to code execution in the content process. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Use-after-free in Mozilla Firefox's DOM: Core & HTML implementation lets remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim loads attacker-controlled web content in an unpatched build. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is network-reachable and low-complexity and requires no authentication, but does depend on user interaction - the victim must open a malicious or compromised page. Every supported channel is affected prior to the fixed releases (Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42); there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though successful heap grooming of the freed DOM object can escalate beyond a crash within the constraints of Firefox's sandbox and mitigations.
RemediationAI
Vendor-released patch: Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42. Update to the fixed build for whichever channel an endpoint runs - mainstream Firefox clients should move to 157 or later, ESR deployments to ESR 153.4, ESR 140.17, or ESR 115.42 depending on their branch - using the standard in-browser updater or a managed deployment package; verify the installed version after the update and consult the Mozilla advisories (https://www.mozilla.org/security/advisories/mfsa2026-100/, mfsa2026-99, mfsa2026-98, mfsa2026-97) and Bugzilla 2068351 for the official record. Because exploitation is a drive-by that requires only that the user render attacker-controlled content, there is no feature toggle or configuration switch that removes the exposure without also breaking normal browsing; for endpoints that cannot be patched immediately, the practical compensating controls are to constrain browsing of untrusted or third-party content (blocking or heavily restricting non-allowlisted sites through policy or a secure web gateway), keeping the Firefox content sandbox and OS-level exploit mitigations enabled so that any memory corruption is contained to the renderer, and increasing monitoring for renderer crashes as a possible exploitation signal - each of these reduces but does not eliminate risk and imposes usability or operational trade-offs, so patching remains the only complete fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in the DOM: Core & HTML component - the browser machinery that builds and maintains the document object model and its associated content nodes. In this class of bug, an object (here a DOM-related allocation) is freed while a stale reference to it remains reachable; when that dangling pointer is later dereferenced, the attacker can operate on reallocated memory, producing memory corruption that in a browser context can be steered toward information disclosure (the associated tag set flags Information Disclosure and Memory Corruption) or, with sufficient heap grooming, arbitrary read/write in the renderer process. CPE data identifies the affected package as cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*, with the fix landed across the 157, ESR 153.4, ESR 140.17, and ESR 115.42 trains, as documented in the Mozilla Foundation security advisories (mfsa2026-97 through mfsa2026-100) and Bugzilla issue 2068351. Modern Firefox exploit mitigations and process sandboxing raise the bar for converting the corruption into full code execution.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted web content with no privileges but requiring the victim to load the page (UI:R); a DOM UAF yields memory corruption with high confidentiality, integrity, and availability impact within the content process.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Executive ViewAI
A high-severity memory corruption flaw in Mozilla Firefox's DOM engine affects every supported release channel, meaning the browsers used across the workforce for email, web applications, and SaaS access are all exposed until updated. A successful attack requires only that an employee visit a malicious or compromised web page - no credentials, no authentication, and no special privileges - after which an attacker could run code on the endpoint within browser sandbox limits. Leadership should care because Firefox is an enterprise-wide attack surface, and a single user's browsing session could become the initial foothold for credential theft, lateral movement, or data exfiltration; there is currently no public exploit code and no confirmed active exploitation (CISA KEV), which gives the organization a short window to act before that changes.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB