The reported issue is a use‑after‑free bug in the Graphics: WebRender component. The flaw occurs when the rendering engine accesses memory that has already been released, which can enable an attacker to trigger unintended behavior. The vulnerability is described as capability for privilege escalation, meaning an exploit could allow a local or user‑originated attacker to gain higher privileges on the host system, though it does not explicitly guarantee arbitrary code execution.

Mozilla Firefox deployments running any version before ESR 153.4, Firefox 157, ESR 115.42, or ESR 140.17 contain the flaw. Mozilla Thunderbird is affected in releases earlier than 157, 140.17, or 153.4. Versions released after those points incorporate the WebRender patch and are not vulnerable.

With a CVSS score of 8.8 the vulnerability is classified as high severity. The EPSS value of less than 1 % indicates a very low probability of exploitation in the wild, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the exploitation surface involves delivering crafted content to the victim’s browser or client, so the attack vector is local or user‑interaction driven and would lead to an elevation of privileges on the affected machine.