A Use‑After‑Free flaw has been identified in the JavaScript Engine component of Mozilla Firefox. When triggered, the flaw can corrupt memory, allowing an attacker to execute arbitrary code or potentially read sensitive data. The weakness corresponds to the common vulnerability type of improper use‑of‑deallocated memory, which can compromise confidentiality, integrity, or availability if successful.

Mozilla Firefox versions prior to 159, and the corresponding ESR releases 115.44 and 153.6, are affected. All earlier releases lacking the patch are vulnerable. The flaw exists in the core JavaScript engine, meaning any subcomponent that executes JavaScript is at risk.

Because the flaw involves an exploitable memory corruption, the potential impact is high. No EPSS score is available, but the lack of an entry in the KEV catalog suggests no known widespread exploitation yet. It is inferred that an attacker would need to deliver malicious JavaScript—either through a web page, email attachment, or other content vector—to trigger the vulnerability. The severity implied by a use‑after‑free is typically high, and while explicit CVSS metrics are missing, the circumstances imply a significant risk to systems that cannot be patched immediately.