HOW A SINGLE TYPO LED TO RCE IN FIREFOX

Summary from the TLDR InfoSec newsletter

A single-character typo (using `&` instead of `|`) in a SpiderMonkey Wasm GC array refactoring commit introduced a use-after-free vulnerability in Firefox's renderer process, enabling arbitrary read/write primitives and full code execution. The bug caused out-of-line array forwarding pointers to be incorrectly zeroed during garbage collection, allowing attackers to reclaim freed memory via heap spraying, bypass ASLR through pointer leaks, and hijack control flow. The vulnerability affected only Firefox 149 Nightly and was patched within six days of the report. No release versions were affected.