The vulnerability is a use‑after‑free flaw in the JavaScript engine, which can allow an attacker to manipulate memory after the original reference has been released. This flaw enables arbitrary code execution, potentially compromising confidentiality, integrity, and availability of the affected system. The weakness is categorized as CWE-416 and is classified as critical with a CVSS score of 9.8.

The flaw affects Mozilla Firefox versions prior to 147 and Firefox ESR prior to 140.7, as well as Mozilla Thunderbird versions prior to 147 and Thunderbird ESR prior to 140.7. These products are used in a wide range of desktop and mobile environments, and any installation of the listed software that has not applied the fix is vulnerable.

With a low EPSS (<1%) the measured likelihood of exploitation is minimal, but the high CVSS suggests that an exploit, if discovered, would be devastating. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is likely through malicious web content or email attachments that trigger the JavaScript engine, but no explicit attack path is provided by the vendor advisory.