This vulnerability is a use‑after‑free flaw within the DOM Workers component of Mozilla Firefox. The flaw occurs when the browser releases an object that may still have active references, leading to memory corruption. If an attacker can trigger this condition, they may cause arbitrary code execution or a denial‑of‑service. The weakness is classified as CWE‑416.

The flaw affects any Mozilla Firefox release prior to the security update included in Mozilla Security Advisory MFSA‑2026‑106. The patch was rolled out in Firefox 158 and in Firefox ESR 153.5, so installations running Firefox 157 or older, or ESR 152 or older, remain vulnerable.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so the exact exploitation likelihood is unknown. Use‑after‑free bugs in browsers are often exploitable when an attacker can supply crafted web content, making the typical attack vector a malicious web page that a user visits. The CVSS score of 5.4 indicates a moderate severity. Given this metric, the issue should be treated as moderate to high severity until further analysis is available.