Endpoint Vulnerability

Crash in incremental garbage collection in JavaScript

Description

Security researcher Jukka Jyl nki reported a use-after-free in JavaScript caused by how objects and pointers are handled during incremental garbage collection in some circumstances working with object groups. When triggered, this causes a potential exploitable crash but is mitigated by the difficulties in controlling the crash and its output.

Affected Products

Firefox

References

CVE-2016-5255,