Use‑after‑free in the DOM: Bindings (WebIDL) component can lead to arbitrary code execution or a crash if an attacker supplies crafted input that triggers the freed memory. The vulnerability is a classic memory corruption flaw, classified as CWE‑416. When exploited, it could compromise the confidentiality, integrity, or availability of the affected system, allowing an attacker to run arbitrary code in the context of the browser.

Mozilla Firefox versions before 158 and Firefox Extended Support Release before 153.5 are affected. All users running those releases on Windows, macOS, Linux, or mobile platforms may be exposed.

No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not disclosed, but use‑after‑free flaws routinely pose a high risk. The attack vector is most likely via a malicious web page or script that exercises the WebIDL bindings; the description indicates that the flaw exists within the DOM handling code. Because the exploitation requires interacting with the browser, it is considered a client‑side attack that can be launched over the internet. Given the nature of the flaw, mitigators should err on the side of caution and treat this as a potential remote code execution vulnerability.