EUVD-2026-98521
GHSA-w5gq-wfgx-wjp5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryDeliver crafted WebAssembly/JS
-
ExploitTrigger use-after-free in Wasm engine
-
ExecutionReuse freed memory for info leak
-
ImpactDisclose sensitive process data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to run a vulnerable Firefox release (prior to 158) and to load attacker-controlled web content that executes crafted WebAssembly to trigger the use-after-free in the JavaScript/WebAssembly engine. WebAssembly is enabled by default, so no special non-default configuration is needed; the primary limiting factor is the required user interaction (UI:R) - the user must navigate to or render the malicious page - and the attacker gains no privileges and causes no availability impact (A:N), with only partial confidentiality/integrity impact (information disclosure) rather than confirmed code execution. |
| Impact | This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction (UI:R) - i.e. the victim must load attacker-controlled web content. Multiple signals agree that real-world urgency is limited: SSVC from CISA rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial', which aligns with the partial C:L/I:L confidentiality/integrity impact and the 'Information Disclosure' tag rather than full code execution. No KEV listing and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was supplied, so probabilistic exploitation likelihood could not be weighed. One point worth flagging: this is a CWE-416 use-after-free in the WebAssembly JIT, a bug class that is historically a strong primitive for sandbox escapes and RCE, yet Mozilla/NVD scored impact as only partial with A:N (no availability impact) - the scored impact therefore looks conservative relative to the typical worst case for UAF, and defenders should treat a future escalation to higher impact as plausible if a working exploit emerges. Overall: patch in normal browser-update cadence; it is not a drop-everything KEV-grade threat on current evidence. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted JavaScript and WebAssembly that triggers a use-after-free in Firefox's WebAssembly component when a victim running Firefox before version 158 visits it. The freed-then-reused memory lets the attacker leak sensitive in-process data (partial confidentiality/integrity impact), potentially bypassing same-origin protections. No public exploit code was identified at time of analysis, and successful attack requires luring the user to the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
A use-after-free in Mozilla Firefox's JavaScript/WebAssembly engine can be triggered when a user loads attacker-controlled web content containing crafted WebAssembly, allowing the attacker to corrupt memory and potentially read or alter data in the browser process. Affected are Firefox releases prior to 158; exploitation is remote and requires no authentication (PR:N) but does require user interaction (UI:R), since the victim must navigate to or render the malicious page, and WebAssembly is enabled by default so no non-default configuration is needed. Impact is scoped to partial confidentiality and integrity loss (C:L/I:L, A:N) rather than confirmed code execution, and no public exploit has been identified at time of analysis; Mozilla addressed the flaw in Firefox 158 and the issue is rated moderate priority rather than an emergency.
RemediationAI
Vendor-released patch: Mozilla Firefox 158 (security advisory mfsa2026-106, Bugzilla 2071764). The primary action is to upgrade all Firefox installations to 158 or later, or to the ESR build that incorporates this fix, and to ensure automatic updates are enabled so managed fleets converge quickly; verify the deployed version rather than relying on update channels alone. If immediate upgrade is not possible, the most direct compensating control is to disable WebAssembly by setting javascript.options.wasm to false in about:config (deployable via enterprise policies or an autoconfig/prefs file) - the trade-off is that legitimate sites and web applications that depend on WASM will break or degrade, so this should be treated as a temporary, scoped measure. Additional risk reduction, with the caveat that it does not eliminate the bug: constrain browsing to trusted content, block untrusted or unknown origins at the web gateway/proxy layer, and enforce strict site isolation and prompt patching of the underlying OS to limit what a memory-corruption primitive could reach; note that these are defense-in-depth measures and only the version upgrade actually removes the vulnerable code path. No public exploit code has been identified at time of analysis, so remediation can proceed on a normal patch cycle consistent with the moderate severity rating rather than an emergency change window.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) in the JavaScript: WebAssembly component - that is, the WebAssembly implementation inside Mozilla's SpiderMonkey JavaScript engine, which compiles and executes WASM modules delivered through ordinary web pages. A use-after-free occurs when code continues to reference a heap object after it has been freed and possibly reallocated, producing a dangling pointer that can be dereferenced as attacker-influenced data; in a JIT/compiler-adjacent engine like SpiderMonkey this class of bug typically arises from mismanaged lifetimes across tiering, compilation, or instance/table teardown paths. Because WebAssembly is enabled by default, the only gate on reachability is the UI:R requirement that a victim render attacker-controlled content; there is no authentication requirement (PR:N) and the attack vector is network (AV:N) with low complexity (AC:L). Per the supplied assessment, the realistic consequence is memory corruption leading to information disclosure and limited integrity impact (C:L/I:L/A:N) rather than a confirmed privilege-escalation or code-execution primitive, and CISA's SSVC evaluation rates exploitation as none, automatable as no, and technical impact as partial. The CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* covers all Firefox releases below the fixed version.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Remote web content with low complexity and no privileges, but requires the user to visit a malicious page (UI:R); UAF yields partial info disclosure (C:L/I:L), no availability impact per vendor.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB