Use-after-free in the DOM UI Events & Focus Handling component can lead to memory corruption during the processing of UI events or focus changes. This flaw may enable the execution of arbitrary code or cause a crash, affecting the confidentiality, integrity, or availability of the browser session.

Mozilla Firefox and Thunderbird are affected. The issue existed in all versions prior to Firefox ESR 153.4, Firefox 157, Thunderbird 153.4, and Thunderbird 157. Users on earlier releases are at risk until they upgrade to a fixed version.

The CVSS score of 8.8 indicates a high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The use-after-free nature suggests severe potential impact. Exploitation would likely involve delivering malicious web content that triggers the faulty UI event handling logic, potentially leading to remote code execution or a denial of service. The attack vector is likely through a malicious web page or compromised script delivered over the network.