The flaw is a use-after-free bug in the JavaScript standard library component of Firefox. A memory safety error of type CWE-416 can allow an attacker to execute arbitrary code with the privileges of the browser process, potentially compromising the entire system. The precise consequences depend on the host environment, but the vulnerability fundamentally undermines the integrity and confidentiality guarantees of the browser.

The issue affects Mozilla Firefox installations running before version 159 on the current release line and before versions ESR 115.44 and ESR 153.6 on the respective long‑term support lines. Any user or organization still utilizing those older releases remains susceptible until they upgrade to a patched build.

While no EPSS score is available and the vulnerability has not been listed in the CISA KEV catalog, the nature of a use-after-free in the core JavaScript engine suggests a high potential for exploitation. The likely attack vector is a malicious or compromised web page delivering crafted JavaScript that triggers the use-after-free, leading to code execution in the browser context. Because the flaw resides in a core component, exploitation would not require elevated privileges beyond the browser process.