This vulnerability is a use‑after‑free flaw in the Gtk component used by Firefox widgets and Thunderbird widgets that allows a sandbox escape; a maliciously crafted widget can trigger the bug and enable the attacker to execute code with higher privileges than the browser normally permits, potentially compromising the host system’s confidentiality, integrity, and availability.

The flaw affects Mozilla Firefox and Mozilla Thunderbird; the patch is delivered in Firefox ESR 153.4, Firefox 157, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. Users running any of these versions or older releases that have not applied the update remain vulnerable.

The EPSS score is < 1%, indicating a very low exploitation probability, and the issue is not listed in the CISA KEV catalog, so no known publicly disclosed exploits exist. The CVSS score is 9.6, indicating a critical severity, and sandbox escapes typically carry a high severity rating. Based on the description, the likely attack vector involves supplying a malicious widget that triggers the use‑after‑free in the Gtk component, which an attacker could deliver via an untrusted web page or content. These inferences should be treated as tentative until more detailed information emerges.