EUVD-2026-88936
GHSA-p2x6-2xrh-qcqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
DeliveryMalicious font/text layout content served
-
ExploitTrigger use-after-free in Layout Text&Fonts
-
ExecutionReclaim freed object to corrupt memory
-
ImpactAchieve code execution in content process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open attacker-controlled web content in an unpatched Firefox (UI:R), where crafted text/font layout data triggers the use-after-free in the Layout: Text and Fonts component - no authentication or special browser configuration is needed, and default settings that render web pages are sufficient. Exploitation is limited by the need for user interaction (visiting or being redirected to a malicious/compromised page) and by version: only builds prior to Firefox 157, ESR 153.4, ESR 140.17, and ESR 115.42 are affected. No sandbox escape is described, so impact is likely scoped to the content process (S:U). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) accurately reflects a client-side browser memory-corruption bug: network-reachable, low-complexity, no privileges, but requiring user interaction (the victim must open attacker-controlled web content). This is a genuine, mainstream-severity issue by virtue of Firefox's ubiquity and the RCE-class nature of a use-after-free, but it is NOT a drop-everything emergency: exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC in the provided intelligence. UI:R is a meaningful limiter (drive-by requires luring a user to a malicious/compromised page), and Mozilla self-reported the flaw with a coordinated fix, which typically means it was found internally/via fuzzing rather than caught in the wild. Contrast the signals: high CVSS + ubiquitous product raise notional exposure, but the absence of KEV/POC/EPSS lowers near-term probability. No SSVC decision points were supplied. Bottom line: patch on a normal-to-expedited browser update cadence; treat as MEDIUM operational priority rather than critical unless active exploitation emerges. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted web page containing malicious text/font layout content that triggers a use-after-free in Firefox's Layout: Text and Fonts component. A victim running an unpatched Firefox visits the page (via phishing link, malvertising, or a compromised site), the freed object is reused to corrupt memory, and the attacker leverages it toward code execution in the content process. No public exploit code is identified at time of analysis; exploitation requires user interaction to open the page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
A use-after-free in Firefox's Layout: Text and Fonts component lets remote attackers corrupt memory by enticing a victim to open crafted web content, potentially leading to code execution within the browser's content process. Unauthenticated network attackers can trigger it with low complexity, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) confirms a successful attack requires user interaction and no privilege is needed beforehand. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; there is no CISA KEV entry and no public exploit identified at time of analysis, though the memory-corruption class makes weaponization plausible.
RemediationAI
Vendor-released patch: upgrade to Firefox 157 or, for ESR channels, to Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 as applicable to the deployed branch, per Mozilla advisories mfsa2026-97 through mfsa2026-100 (https://www.mozilla.org/security/advisories/mfsa2026-100/) and the upstream fix tracked in https://bugzilla.mozilla.org/show_bug.cgi?id=2070264. Because exploitation requires the victim to open attacker-controlled content, interim compensating controls are limited but usable: enforce prompt update enforcement via enterprise policy (AppUpdatePin/DisableAppUpdate left unset so updates install), and reduce exposure by disabling downloadable web fonts via the gfx.downloadable_fonts.enabled preference, which shrinks the font-parsing and layout attack surface at the cost of degraded or broken typography on many sites. Additional hardening such as enabling strict content-process sandboxing and site isolation does not prevent the use-after-free but constrains post-exploitation impact to the content process, and network-layer blocking of untrusted sites is impractical as a standalone control given how broadly web content is consumed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-416 (Use-After-Free) in the Layout: Text and Fonts component, the Gecko subsystem that handles line breaking, glyph shaping, and font resource lifecycle during page rendering. When text and font layout data is processed, a freed object can still be dereferenced, producing memory corruption that in a browser engine can be steered toward arbitrary read/write inside the content process. The vulnerability is client-side and renderer-level rather than in networking or privilege-management code; the CVSS vector shows scope unchanged (S:U), consistent with impact confined to the sandboxed content process absent a separate sandbox escape. The CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* is a wildcard covering all Firefox channels and versions, meaning version filtering must come from the vendor advisory rather than the CPE string.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page with no privileges but requiring the victim to open it (UI:R); use-after-free memory corruption yields RCE-class C/I/A:H within the unchanged content-process scope.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Executive ViewAI
A high-severity memory-corruption flaw in Mozilla Firefox can let an attacker run malicious code inside the browser's content process by persuading a user to open a crafted web page, putting any employee who browses untrusted or user-supplied content at risk. No vendor patch is available at this time and there is no confirmed exploitation, but the attack is unauthenticated, low-complexity, and requires only that a user open a page, so the exposure window is broad and open-ended until fixed builds are deployed. Leadership should care because the affected browsers are common on corporate endpoints and the fix depends on an upgrade cycle we do not yet control.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce enterprise browser policy to harden the content sandbox and restrict script/plugin execution, reduce browsing of untrusted or user-supplied web content on high-risk endpoints, isolate or virtualize browser sessions for users who must visit untrusted sites, monitor crash and memory-corruption telemetry for exploitation attempts, and prioritize expedited upgrade to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 as soon as vendor packages are obtainable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB