The flaw is a use‑after‑free in the DOM: Core & HTML component of Mozilla’s products, classified as CWE‑416, CWE‑825. When a web page frees memory that a running script still references, the garbage collector can reuse that memory area, allowing the attacker to craft code that runs with elevated privileges. This enables a sandbox escape, giving the attacker the ability to execute arbitrary code outside the browser’s restricted environment. The impact is the potential compromise of the host operating system.

All Mozilla Firefox and Thunderbird installations that run versions released before the security fix are affected. This includes Firefox ESR 140.17, Firefox 157, Firefox ESR 153.4 and all earlier builds, as well as Thunderbird 140.17, Thunderbird 157, Thunderbird 153.4 and earlier. The vulnerability spans Windows, macOS, Linux and any other supported platforms, and applies to every installation that used one of the listed products prior to those patched versions.

The CVSS base score of 9.6 classifies the issue as critical. The EPSS score is reported as less than 1 %, indicating a very low probability of exploitation at the time of this analysis, but the risk remains high because the flaw enables unrestricted code execution. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, generally triggered by a malicious or compromised web page that the victim browses. An attacker can deliver crafted content, cause a use‑after‑free, and then execute code with privileges beyond the browser sandbox, potentially taking full control of the host system.