Use‑after‑free was discovered in Firefox’s JavaScript WebAssembly engine. The flaw allows an attacker to read or write arbitrary memory after a freed object, which can lead to browser crashes or provide a foothold for further exploitation. This is a classic memory corruption weakness that may enable compromise of the browser process.

Mozilla Firefox versions prior to 158 are affected. All users running these editions of the browser are potentially vulnerable until the fix shipped in version 158 is applied.

Use‑after‑free could allow an attacker to read or write arbitrary memory after a freed object. The CVSS score is 5.4. While the CVE description does not explicitly state remote code execution, it is commonly understood that such a flaw could enable execution of malicious code in the browser process—this is inferred rather than proven. No public exploits or zero‑day activity have been reported; the EPSS score is not available. The flaw is not listed in CISA’s KEV catalog, indicating limited evidence of active exploitation. Attackers would require the ability to run JavaScript or load WebAssembly modules in a vulnerable browser instance, making the vector local to the user’s browsing activity.