Technical impact
The CVE identifies a use-after-free flaw in the JavaScript WebAssembly component of Mozilla products. The description does not explicitly state the consequences. Based on the nature of use-after-free vulnerabilities, the flaw could potentially lead to memory corruption or execution of arbitrary code, but this is inferred. Potential impact may involve compromise of confidentiality, integrity, or availability of the user’s system, though the description does not confirm these outcomes.
Affected Systems
Mozilla Firefox browsers running versions prior to ESR 153.4 and the standard Firefox build 157 are affected, and Thunderbird versions prior to 157 and 153.4 are also affected. Users on earlier ESR or non-ESR releases of Firefox are potentially vulnerable.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been reported. The attack vector is likely remote via malicious WebAssembly modules embedded in web pages; this inference is based on typical exploitation patterns for browser component flaws. Exploitation would require the victim to open a compromised page, as is typical for browser vulnerabilities.
Debian DLA
Debian DSA