Use After Free

Touching memory after it has been freed — the dangling pointer behind a decade of browser exploits.

Core Principles & Analysis

• An attacker who reallocates the freed slot controls what the dangling pointer now points at.
• It has been a dominant class of exploited browser bugs, prized for bypassing memory defenses.
• Memory-safe languages and heap quarantines exist largely to kill this bug class.

Specifications & Metrics

• CWE: CWE-416
• IMPACT: Code execution