This vulnerability involves a use‑after‑free condition within the DOM: Bindings (WebIDL) component. The flaw can lead to memory corruption if malicious input triggers a freed memory region. This poses a risk of application instability, data corruption, or potential exploitation depending on the context. The weakness is classified as CWE‑416.

Mozilla Firefox versions before 158 and Firefox Extended Support Release before 153.5, as well as Mozilla Thunderbird versions before 158 and Thunderbird Extended Support Release before 153.5, are affected. All users running those releases on Windows, macOS, Linux, or mobile platforms may be exposed.

No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.4, indicating moderate severity. The likely attack vector is via a malicious web page or script that exercises the WebIDL bindings; the description indicates that the flaw exists within the DOM handling code. Because exploitation requires interaction with the browser, it is considered a client‑side attack that can be launched over the internet. Given the nature of the flaw, mitigators should err on the side of caution and treat this as a potential remote code execution vulnerability.