A use‑after‑free vulnerability in Mozilla’s Canvas2D graphics component permits the sandbox to be bypassed, potentially allowing attackers to execute code outside the browser or email client’s restricted environment. This flaw is an example of CWE‑416, i.e., memory safety errors that can lead to arbitrary code execution once an attacker is able to control the freed memory region. The impact includes the possibility of full system compromise if the sandbox escape is leveraged, as privileges granted to the browser process can be abused.

The breach affects Mozilla products, specifically Firefox versions prior to 143 (and ESR 140.3) and Thunderbird versions prior to 143 (and ESR 140.3). Host operating systems listed in the CPEs include Red Hat Enterprise Linux 9 and 10, but the vulnerability resides solely in the application layer of the browser and mail client.

The CVSS score of 7.1 indicates a high‐severity risk, yet the EPSS score of <1% suggests a very low probability of exploitation in the wild so far. The vulnerability is not currently catalogued in CISA’s KEV list. Attackers would need to supply malicious content that exercises the broken Canvas2D logic, implying that the vector is likely a remote web page or phishing email that includes canvas elements. Under the current threat landscape, responsible parties should prepare to mitigate the risk promptly due to the critical nature of sandbox escape flaws.