The vulnerability is a use‑after‑free flaw in the DOM core and HTML component that permits a sandbox escape, allowing untrusted code to break out of the browser sandbox and execute arbitrary code on the host system. This can lead to compromise of system integrity and privilege escalation, and may expose sensitive data. The weakness is a classic use‑after‑free error.

All Mozilla Firefox releases prior to the following patches are affected: Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, and standard Firefox 157. Any older versions remain vulnerable, as do all Thunderbird releases prior to Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.

Detailed CVSS data for this issue is publicly available with a score of 9.6, while EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be content delivered by a malicious website or code executed within the browser’s sandbox. An attacker with sufficient access to trigger the use‑after‑free could escape the sandbox and execute arbitrary code on the host system, posing a high damage potential if the sandbox is the only isolation boundary in place. Although it has been fixed in Firefox ESR 153.4, ESR 140.17, ESR 115.42, and standard Firefox 157, as well as Thunderbird 157, 140.17, and 153.4, the risk persists for older versions.