This vulnerability is a use‑after‑free flaw within the DOM Workers component of Mozilla Firefox and Thunderbird. The flaw occurs when the browser releases an object that may still have active references, potentially leading to memory corruption. The precise impact depends on the exploitation but could involve denial of service or other compromise. The weakness is classified as CWE‑416.

Mozilla Firefox releases prior to version 158 and Firefox ESR 153.5, as well as Mozilla Thunderbird prior to version 158 and Thunderbird ESR 153.5, are vulnerable. Installations running older versions remain at risk.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so the exact exploitation likelihood is unknown. Use‑after‑free bugs in browsers are often exploitable when an attacker can supply crafted web content, making the typical attack vector a malicious web page that a user visits; the likely attack vector is inferred from these patterns. The CVSS score of 5.4 indicates a moderate severity. Given this metric, the issue should be treated as moderate to high severity until further analysis is available.