The issue involves memory safety bugs in Mozilla Firefox 146 that can corrupt memory, with evidence that insufficiently validated data could be abused to execute arbitrary code. The vulnerability is categorized as CWE-119 – an uncontrolled memory write that can lead to arbitrary control‑flow hijacking. The official description notes that while not all bugs demonstrated an immediate exploit, the presence of memory corruption suggests that, with sufficient effort, an attacker might achieve remote code execution by crafting malicious content.

Affected products include Mozilla Firefox 146.x builds prior to the 146.0.1 release. Any installation of Firefox that has not been updated to 146.0.1 or later is vulnerable. The fix was applied in the 146.0.1 patch bundle, so systems running that or newer versions are not affected.

The CVSS score of 8.8 reflects a high severity due to the potential for arbitrary code execution, but the EPSS score of less than 1% indicates that the vulnerability is presently unlikely to see widespread exploitation. It is not listed in the CISA KEV catalog, further suggesting a low exploitation probability. Attackers would need to deliver crafted memory corruption through user‑controllable input—such as a malicious web page or unsecured extension—to trigger the vulnerability, making active exploitation both technically demanding and relatively rare.