The vulnerability involves improper handling of memory boundaries within Firefox’s networking component, resulting in a use‑after‑free that allows a sandboxed process to escape isolation. This flaw gives an attacker the ability to execute arbitrary code or elevate privileges beyond the sandbox, potentially leading to full system compromise.

All installations of Mozilla Firefox older than version 158 and Firefox ESR before 153.5, as well as Mozilla Thunderbird older than version 158 and Thunderbird ESR before 153.5, are vulnerable. Unpatched versions on Windows, macOS, and Linux platforms remain affected.

Because the flaw resides in the networking stack, the most direct route to exploitation is through network traffic, such as a malicious HTTP response or embedded content received by the browser. The vulnerability is a remote code‑execution vector with no known public exploit, and its EPSS score of 0.00311 indicates a very low likelihood of exploitation, but the lack of an available exploit does not reduce the inherent severity of a sandbox escape. The lack of KEV listing indicates that no large‑scale attacks have been observed yet, but the high impact warrants prompt mitigation. Attackers could abuse the flaw to breach the sandbox and run arbitrary code, achieving full control of the client machine. The CVSS score of 9.6 indicates a severe vulnerability.