Use-After-Free (UAF) is a memory corruption vulnerability where a program continues to use a pointer after the memory it points to has been freed (delete, free). The dangling pointer accesses freed memory, which may have been reallocated with attacker-controlled data (heap spray, object reuse). Attackers exploit UAF to overwrite vtable pointers (C++ virtual functions), function pointers, or return addresses, leading to arbitrary code execution (RCE). UAF is common in C++ applications (browsers - Chrome V8, Firefox SpiderMonkey, Edge Chakra, Safari WebKit). 30% of browser zero-days are UAF vulnerabilities (Google Project Zero).
UAF Statistics: 30% of browser zero-days are UAF vulnerabilities. 60% of UAF vulnerabilities occur in C++ virtual functions (vtable overwrite). Average CVSS score: 8.8 (High). Chrome patches 10+ UAFs per year.
Common UAF targets:
UAF in C++ object → attacker reallocates freed memory with fake vtable. Virtual function call uses attacker-controlled vtable → redirects to shellcode. Most common UAF exploitation technique.
UAF overwrites function pointer in freed object. Program calls function pointer → executes attacker code.
UAF corrupts security-critical data (uid, gid, is_admin flag). Escalates privileges from user to root.
Heap spray fills freed memory with controlled data (NOP sled + shellcode). Increases exploit reliability.
// Browser Use-After-Free example (JavaScript + C++ DOM objects)
// Vulnerable browser engine (WebKit, Blink)
// C++ DOM object (HTMLDivElement) freed but JavaScript retains reference
// 1. Create DOM element
var div = document.createElement("div");
// 2. Free object (C++ delete)
div.parentNode.removeChild(div); // HTMLDivElement freed
// 3. Use-after-free (dangling JavaScript reference)
div.innerHTML = "UAF payload"; // Accesses freed memory
// 4. Heap spray to control freed memory
var spray = [];
for (var i = 0; i < 100000; i++) {
spray.push(new ArrayBuffer(0x1000));
}
// 5. Overwrite vtable pointer (point to fake vtable)
// Fake vtable redirects to shellcode
// 6. Trigger virtual function call
div.appendChild(otherElement); // Calls vtable function → shellcode executed
// Example: CVE-2020-16040 (Chrome UAF) - fixed in Chrome 87
Use-After-Free in Chrome V8 JavaScript engine (Chrome 86). Remote code execution via crafted website. Fixed in Chrome 87.
Use-After-Free in Firefox (Sandbox escape). Remote code execution via crafted webpage. Fixed in Firefox 68.
Win32k Use-After-Free (Windows kernel). Local privilege escalation (user → SYSTEM). Exploited in the wild. Fixed in February 2021 patch.
Use-After-Free in Microsoft Office Equation Editor (EQNEDT32.EXE). Remote code execution via crafted Office document. Notorious for ransomware delivery.
// Use-After-Free statistics (2023-2024)
- 30% of browser zero-days are UAF vulnerabilities (Google Project Zero)
- 60% of UAF vulnerabilities occur in C++ virtual functions (vtable overwrite)
- 25% occur in function pointers (callback functions, event handlers)
- 15% occur in data fields (privilege escalation)
- Chrome patches 10+ UAF vulnerabilities per year
- Firefox patches 5+ UAF per year
- Average CVSS score: 8.8 (High - Critical)
- 70% of UAF vulnerabilities are memory corruption (RCE)
- 20% lead to privilege escalation
- 10% lead to denial of service
// Most affected software categories
1. Web browsers (Chrome, Firefox, Edge, Safari): 50%
2. Operating systems (Windows kernel, Linux kernel): 20%
3. Microsoft Office (Word, Excel, Equation Editor): 15%
4. PDF readers (Adobe Reader, Foxit): 10%
5. Game engines: 5%
This demonstration simulates a C++ Use-After-Free vulnerability (virtual function call after delete):
This is a simulated demonstration. Real UAF exploits (Chrome V8, Firefox SpiderMonkey) achieve RCE via vtable overwrite. Defenses: Set pointers to NULL after free (ptr = nullptr). Use smart pointers (unique_ptr, shared_ptr). Enable AddressSanitizer (ASan) during development. Use static analysis (Clang Static Analyzer, Coverity).
Detects Use-After-Free at runtime (quarantine, poison memory). Reports heap-use-after-free error with stack trace.
Detects Use-After-Free, invalid reads/writes, memory leaks. Slower but thorough.
Detects potential Use-After-Free (pointer used after delete). Flags dangling pointer usage.
Fuzzing with ASan enabled detects UAF crashes. Chrome uses ClusterFuzz for UAF detection.
Always set pointer to NULL after delete/free. Prevents dangling pointer access (segmentation fault instead of UAF).
C++ unique_ptr, shared_ptr automatically manage memory. Prevents manual delete/free errors.
Enable ASan in debug builds. Detects UAF during testing (unit tests, fuzzing).
Rust's ownership model prevents Use-After-Free at compile time. Go's garbage collector avoids manual memory management.
Best Practice - Smart Pointers + ASan + Null Pointers: Use smart pointers (unique_ptr, shared_ptr) instead of raw pointers. Set pointers to NULL after delete (ptr = nullptr). Enable AddressSanitizer (ASan) in CI/testing. Use static analysis (Clang Static Analyzer). For browsers, enable MiraclePtr (Chrome) / CFG (Edge) to mitigate UAF.
Use-After-Free exploitation is illegal when used without authorization (CFAA). Ethical uses include:
Use-After-Free exploits are illegal when used without authorization. Penalties include:
Important: This guide is for educational and defensive purposes only. Only test UAF vulnerabilities on systems you own or have explicit written authorization. Responsible disclosure to vendors.
Memory error detector (heap-use-after-free, stack-use-after-return).
Technical analysis of Chrome, Firefox, Edge UAF vulnerabilities.
Chrome's defense against Use-After-Free (MiraclePtr, BackupRefPtr).