The vulnerability is a use‑after‑free condition in the native messaging web‑extension API that can lead to crashes on Windows. The memory corruption can cause Mozilla Thunderbird or Firefox to terminate unexpectedly, resulting in a denial‑of‑service situation. The description does not indicate that the flaw can be used to achieve code execution or data exfiltration; it only mentions crashes.

Mozilla Thunderbird versions beginning with 143 on Windows are affected until the bug is fixed in version 144. Mozilla Firefox was patched in version 144, indicating that earlier releases may also be vulnerable, but the provided description does not identify specific Firefox versions that are impacted.

The CVSS score of 9.8 indicates a high‑severity flaw. The EPSS score is reported as less than 1 %, meaning the likelihood of exploitation is very low under current conditions. Because the CVE is not listed in the CISA KEV catalog, there is no known widespread exploitation in the wild. The likely attack vector would involve a malicious web extension running on a Windows machine; however, exploitation would still depend on the extension having native messaging privileges and would only lead to crashes rather than more severe compromise.