The flaw is a use‑after‑free in the CSS parsing and computation component, a CWE‑416 and CWE‑825 weakness. This type of vulnerability allows the software to access memory after it has been freed, which can enable an attacker to trigger arbitrary code execution when the application processes malicious CSS data. The advisory does not detail exactly how an attacker would exploit the vulnerability, so the extent of the potential impact is inferred from similar use‑after‑free bugs.

Mozilla products that contain the flaw are Firefox ESR builds older than 153.4, standard Firefox releases before 157, Thunderbird releases prior to 153.4 and 157. The security fix was applied in Firefox ESR 153.4, Firefox 157, Thunderbird 153.4, and Thunderbird 157.

The CVSS score of 8.8 qualifies the issue as high severity. The EPSS score of less than 1% indicates a low probability of active exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector would involve an attacker delivering malicious CSS to a user while the affected application is running, such as on a compromised webpage or in an e‑mail with unsafe styling. This scenario is plausible for users who browse the internet or receive mail from untrusted sources. Given the high severity and the availability of patches, systems still on vulnerable versions face a significant risk if the flaw is not remediated promptly.