Memory safety bugs were present in Firefox 136 and Thunderbird 136, leading to memory corruption that could, with significant effort, allow an attacker to execute arbitrary code on an affected system. The vulnerability carries a CVSS score of 8.1, indicating a high severity for exploitation. While no confirmed production exploitation has been reported, the description suggests that the bugs were serious enough to warrant a patch.

Mozilla products Firefox and Thunderbird are affected. Version 136 of both browsers contains the bugs while version 137 and later incorporate the fixed code. No other versions are listed as impacted.

The EPSS score of less than 1% indicates that the likelihood of exploitation at this time is low, and the vulnerability is not currently listed in the CISA KEV catalog. However, the high CVSS score and the potential for arbitrary code execution mean that the risk to any system running the vulnerable versions remains significant. A patch is the only reliable protection, and delayed remediation would leave systems vulnerable to an exploited memory corruption flaw.