Use‑after‑free in the Storage: IndexedDB component of Mozilla Firefox and Thunderbird. The flaw allows a freed object to be accessed while still referenced, causing memory corruption and undefined behavior, potentially leading to crashes or other instability. The issue was addressed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

The problem affects all Mozilla Firefox releases older than the fixes, specifically non‑ESR Firefox before version 158 and ESR builds prior to 115.43 and 153.5. It also impacts Mozilla Thunderbird releases before version 158 and ESR builds before 153.5. Users running any of these versions are at risk until they upgrade to a patched build.

The CVSS score is 5.4, indicating a moderate severity. The EPSS score of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is client‑side and would likely be triggered by malicious content that uses IndexedDB, the potential for exploitation appears moderate and no confirmed exploitation is reported.