Use‑after‑free vulnerability in the DOM: Core & HTML components of Mozilla Firefox allows a malicious web page to corrupt memory. The vulnerability is rated with a CVSS score of 8.8, indicating a severe risk. Based on the nature of the weakness and the high CVSS score, it is inferred that the memory corruption could enable arbitrary code execution, but the official description does not explicitly state this outcome.

Mozilla Firefox browsers are affected. The fix was released for Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. Mozilla Thunderbird email clients are affected. The fix was released for Thunderbird 153.4, Thunderbird 140.17, and Thunderbird 157. Any earlier releases that have not received these updates are potentially vulnerable.

EPSS score is 0.311% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via crafted web content, such as a malicious HTML or JavaScript page loaded in the browser or email client. The vulnerability is a use‑after‑free error, which means it requires the victim to view the offending page or email; no local exploitation prerequisites are disclosed. The high severity CVSS score and the nature of the flaw suggest that if exploited, an attacker could gain code execution with the privileges of the user running the browser or Thunderbird.