Based on the updated description, the vulnerability is still a use‑after‑free in the DOM Core and HTML component of Mozilla Firefox. It enables attackers to trigger memory corruption that can lead to arbitrary code execution or manipulation of browser behavior. The flaw occurs when a memory block is freed while still referenced, giving an attacker a window to run malicious code if malicious content is loaded.

Mozilla Firefox and Thunderbird are affected. The issue was addressed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6; any release prior to these versions may contain the vulnerability.

Exploit details are not publicly documented, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of a use‑after‑free in the browser’s core, the likely attack vector is a malicious web page or JavaScript that triggers the DOM manipulation. The risk is high because the flaw can lead to arbitrary code execution in the context of the user’s browser.