The flaw is a use‑after‑free bug in the Preferences: Backend component of both Mozilla Firefox and Thunderbird. An attacker can exploit this undefined memory access to escape the browser or email client sandbox, allowing execution of arbitrary code with the privileges of the respective process. The weakness is categorized as CWE-416 and CWE-825 and can undermine both confidentiality and integrity of the system.

All releases of Mozilla Firefox and Thunderbird older than version 157 are potentially affected, as the fix was delivered in 157 for both products. The advisory does not specify a narrower range, so any deployment using a pre‑157 build of either product runs the risk.

The CVSS score of 9.6 places the vulnerability in the critical danger zone, indicating a high potential for exploitation if a suitable trigger is found. Despite this severity, the EPSS score of < 1% shows a very low probability of active attacks in the wild at this time. The vulnerability remains unlisted in CISA KEV, so there is no known large‑scale exploitation. An attacker could exploit the use‑after‑free in the Preferences backend to escape the browser or client sandbox and execute code with the process privileges. Potential vectors might involve malicious web pages or local attackers manipulating the Preferences component, but the exact trigger is not detailed in the advisory.