Use‑after‑free in the DOM: Core & HTML component. This defect has been fixed in Firefox ESR 153.4, Firefox 157, and Thunderbird 140.17, 153.4, 157. The flaw involves unsafe use of memory after it has been released, identified as CWE-416 and CWE-825.

All Mozilla Firefox releases that are older than the fixed versions are affected. The was applied in Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, and Firefox 157. All Mozilla Thunderbird releases older than Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157 are also vulnerable. Users running any earlier ESR, stable, or Thunderbird build prior to these versions are susceptible.

Based on the description, it is inferred that exploitation would require an attacker to supply malicious content that triggers the use‑after‑free scenario, such as a crafted web page or script. No public exploit has been documented, and the vulnerability is not currently listed in CISA's KEV catalog; the EPSS score is less than 1%, indicating a low probability of exploitation. Nonetheless, the potential for arbitrary code execution poses a high risk to systems – including browsers and email clients – exposed to untrusted web or email content.