CVE-2026-109725

Executive Summary

CVE-2026-109725 is a use-after-free (UAF) vulnerability in the DOM: Core & HTML component of Mozilla Firefox, fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. It affects users running earlier versions of Firefox and the corresponding ESR branches; successful exploitation typically requires a victim to visit attacker-controlled content. Impact can include memory corruption leading to arbitrary code execution or a sandbox-escape-enabling crash in the browser process context.

Technical Analysis

The vulnerability class is a use-after-free in the browser's DOM: Core & HTML subsystem. In Firefox, DOM: Core & HTML covers the implementation of document object model interfaces, element lifecycle, and the HTML parser/event-handling machinery that bind web content to the internal object graph. Use-after-free conditions arise when a JavaScript-reachable DOM wrapper (or an associated internal object such as a node, element, or event target) is released while a reference to it is retained and subsequently dereferenced.

In practice, the browser's garbage-collected scripting layer and the reference-counted native DOM layer are connected through cycle-collector and wrapper-preservation logic. A UAF can occur when this inter-layer ownership accounting is inconsistent — for example, if a DOM object is freed during a callback or re-entrancy window while a still-reachable wrapper or speculatively held pointer continues to reference it. The result is a dangling pointer dereference, which can manifest as:

1. A crash (memory-safety violation) — the most common observable outcome.
2. A corrupted object graph in which an attacker-controlled object overlaps freed memory, potentially enabling arbitrary read/write primitives if the freed allocation is reclaimed with attacker-influenced data.

The NVD description does not disclose the specific DOM interface, method, or code path responsible. No function names, DOM APIs, or internal symbols are provided, and none are asserted here. The attack surface is the content process: a web page (or embedded iframe/document) delivered to the browser and rendered/parsed by the DOM: Core & HTML engine. Exploitation generally requires JavaScript execution, since DOM object lifetimes and wrapper interaction are most directly manipulated from script, though parsing-driven re-entrancy (HTML parsing interacting with script) is also a plausible trigger class for DOM/HTML UAF bugs.

Because no CVSS score was assigned in the provided data (CVSS: N/A), no numeric severity can be stated. The vector shown above reflects a typical browser client-execution profile (network-accessible, requires user interaction, high confidentiality/integrity/availability impact) and is provided as a modeling aid, not as an assigned vendor score.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this CVE as of the provided data, and no details of the vulnerable code path are disclosed. The attack chain is therefore described at the vulnerability-class level.

1. Reconnaissance / target identification An attacker identifies targets running vulnerable Firefox builds — versions below 158, below ESR 115.43, or below ESR 153.5. This can be done passively via user-agent strings captured by a watering-hole site or an ad/analytics endpoint, or by serving a malicious page broadly and gating exploitation on detected browser version. Enterprises standardizing on an ESR branch are prioritized targets until ESR 115.43 / ESR 153.5 are deployed.

2. Triggering the flaw The victim must load attacker-controlled web content in the vulnerable browser. The content is crafted to drive the DOM: Core & HTML implementation into the inconsistent object-lifetime state that produces the use-after-free. Because the exact trigger is undisclosed, a weaponized page would exercise DOM and HTML-parsing behaviors under script control to reach the free-then-use condition. Common UAF trigger patterns for DOM components include scripted manipulation of node/document lifecycle and parsing callbacks that re-enter script during object teardown; the specific pattern for this CVE is not public.

3. Payload / execution method At the vulnerability-class level, the attacker's page performs heap grooming so that the memory region of the freed DOM object is reallocated with controllable data, then causes the dangling reference to be dereferenced. If the reclaimed allocation is attacker-influenced, the dereference can yield memory corruption that may be steered toward code execution inside the Firefox content process.

4. Post-exploitation impact Successful exploitation yields code execution in the content (renderer) process sandbox. From there, a typical chain pivots to sandbox escape to reach the host; alternatively, the immediate impact may be a reliable denial-of-service crash. Compromise of a workstation browser gives an attacker a foothold for credential theft, lateral movement, or implant staging. If exploit reliability is low (as is common for UAF without public details), the practical near-term risk is crash/DoS rather than reliable RCE — but that assessment can change rapidly if a PoC is published.

Note: No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Affected systems are endpoints running Mozilla Firefox (release channel) before 158, Firefox ESR before 115.43, and Firefox ESR before 153.5, across Windows, macOS, and Linux. Blast radius is the entire vulnerable browser install base in an organization, which for many enterprises is large and includes privileged users (administrators, developers, finance) — making browser compromise a high-value initial-access objective.

Impacts include:

• Availability: browser crashes / tab or process termination; reliable DoS is plausible even without an RCE primitive.
• Confidentiality/Integrity: if weaponized, memory corruption can lead to content-process code execution, enabling data theft (session cookies, tokens, in-browser data) and further implant deployment; sandbox escape would elevate to full host compromise.

No CVSS base score was assigned in the data provided (CVSS: N/A), so no numeric severity is declared. CISA KEV status is NO, and no EPSS score is available (not yet scored by FIRST.org), meaning there is no current signal of confirmed in-the-wild exploitation. Impact should nevertheless be treated as high given the affected component (DOM core) and the historical frequency with which Firefox DOM UAFs are exploited in targeted campaigns.

Detection Guidance

Sigma Rule

title: Potential Firefox DOM Use-After-Free Exploitation Attempt (CVE-2026-109725)
id: 7e5f0f2c-8f0b-4c2e-9b1a-2c9d6f0a1b23
status: experimental
description: Detects Firefox process crashes/child process terminations that may indicate exploitation of a DOM use-after-free (CVE-2026-109725). Correlate with browser version < 158 / ESR < 115.43 / < 153.5.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109725
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\firefox.exe'
  selection_crash:
    CommandLine|contains:
      - 'crashreporter'
      - '-greomni'
  condition: selection_img and selection_crash
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate Firefox crash reporting from normal crashes
level: low
tags:
  - attack.t1203
  - cve.2026.109725

YARA Rule

rule EXPL_CVE_2026_109725_Firefox_DOM_UAF
{
    meta:
        description = "Heuristic detection of HTML/JS content attempting to trigger DOM: Core & HTML use-after-free conditions in vulnerable Firefox builds (CVE-2026-109725). Generic class-level indicators only; no public PoC pattern available."
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109725"
        severity = "medium"

    strings:
        $js1 = "document." ascii nocase
        $js2 = "createElement" ascii nocase
        $js3 = "appendChild" ascii nocase
        $js4 = "removeChild" ascii nocase
        $heap1 = "ArrayBuffer" ascii nocase
        $heap2 = "Uint32Array" ascii nocase
        $heap3 = "try{" ascii nocase

    condition:
        uint16(0) == 0x3C21 or uint16(0) == 0x6874 or // "<!" or "th" (HTML)
        (2 of ($js*) and 2 of ($heap*))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"EXPLOIT Possible Firefox DOM Use-After-Free Trigger Delivery (CVE-2026-109725)"; flow:established,to_server; http.method; content:"GET"; http.user_agent; content:"Firefox/"; nocase; pcre:"/Firefox\/(1[0-4][0-9]|15[0-7])\.[0-9]/"; reference:cve,2026-109725; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109725; classtype:attempted-user; sid:2026109725; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name : "firefox.exe" and
  process.args : "*crashreporter*"

Splunk SPL Query

index=endpoint (process_name="firefox.exe" OR process_name="firefox")
| where match(process_command_line, "(?i)crashreporter|greomni")
| stats count values(process_command_line) as cmd by host, user
| where count > 0

Wazuh OSSEC Rule

<group name="firefox,cve-2026-109725,">
  <rule id="100725" level="5">
    <decoded_as>json</decoded_as>
    <field name="process">firefox</field>
    <match>crashreporter</match>
    <description>CVE-2026-109725: Firefox child process crash/telemetry activity possibly related to DOM use-after-free exploitation</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The description states the issue "was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5"; however, no vendor advisory URL, commit, or patch reference was supplied in the tracked sources, so patch confidence remains 0/4 and no patch artifact can be cited.

1. Immediate mitigations

• Update to the fixed builds as identified by the maintainer: Firefox 158, Firefox ESR 115.43, or Firefox ESR 153.5 (verify the exact fixed build against Mozilla's official release notes before deploying).
• Where immediate upgrade is impossible, restrict browsing to managed allowlists, disable unnecessary JavaScript (e.g., NoScript-class controls) via enterprise policy, and enforce strict site isolation where available.
• Deploy browser crash monitoring and alert on abnormal content-process crash spikes for Firefox.
• Block or sandbox untrusted web content and enforce download/attachment controls.

2. Patch / upgrade steps

• Inventory Firefox installs and identify any below 158, below ESR 115.43, or below ESR 153.5.
• Stage and push the fixed builds through your patch/software management pipeline; prioritize ESR users and privileged endpoints.
• Verify post-upgrade version via about:support or enterprise reporting; confirm no users remain on vulnerable branches.

3. Long-term hardening

• Maintain a rapid browser-update cadence (browsers are a top initial-access vector).
• Enforce exploit mitigations (ASLR/DEP/CFG) and OS-level hardening; keep browser sandboxing enabled.
• Monitor Mozilla security advisories and add them to your vulnerability intake feed.
• Adopt EDR with browser-crash and memory-corruption heuristics to shorten detection time.

References

• NVD — CVE-2026-109725: https://nvd.nist.gov/vuln/detail/CVE-2026-109725
• Mozilla Security Advisories (Firefox / ESR release notes covering the fix in Firefox 158, ESR 115.43, ESR 153.5): https://www.mozilla.org/security/advisories/
• Mozilla Foundation Security Advisories index: https://www.mozilla.org/en-US/security/advisories/
• CWE-416 Use After Free: https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• CISA KEV Catalog (status: CVE-2026-109725 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-109725 in the provided data; CISA KEV status is NO, no public PoC/exploit code exists, and no EPSS score is available.