This vulnerability is a use‑after‑free flaw in the Layout component of Firefox. When triggered, it allows an attacker to incorrectly reference freed memory, potentially leading to a program crash or, in some configurations, to arbitrary code execution. Properly crafted web content could exploit the flaw by manipulating layout rendering paths. The type of weakness is consistent with memory corruption scenarios that undermine program integrity.

The flaw affects Mozilla Firefox releases prior to the fixes in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6. Users running older versions of the browser are therefore vulnerable. All other product lines of Mozilla’s web browser that contain the same Layout component version are also at risk.

No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, meaning no official exploitation statistics are provided. However, use‑after‑free bugs in rendering engines are historically high‑risk and have been leveraged in the past for remote code execution. The attack vector is likely through a maliciously crafted web page or content that triggers the layout logic, allowing the exploit to be launched from the user’s platform with permission to load the page. Given the severity associated with memory corruption vulnerabilities, the risk is judged to be high until the affected systems are updated.