The vulnerability is a use‑after‑free condition in the JavaScript WebAssembly engine. Based on the description, it is inferred that an attacker could supply a malicious WebAssembly module via a compromised website or phishing email to either Firefox or Thunderbird, causing the browser to dereference freed memory. This corruption can potentially be leveraged to execute arbitrary code or crash the browser. The weakness is classified as CWE‑416, a classic use‑after‑free flaw.

Mozilla Firefox and Thunderbird are affected. All releases prior to version 157 of each product are vulnerable, as the flaw was fixed starting with that release.

EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, so publicly available data about exploitation likelihood is limited. The CVSS score of 8.8 indicates a high severity risk to confidentiality, integrity, and availability if exploited. An attacker would need to deliver a malicious WebAssembly module to the victim’s browser, which could be achieved via a compromised website or phishing.