The vulnerability is a use‑after‑free bug in the CSS parsing and computation component of Mozilla Firefox. This flaw allows a crafted CSS context to reference freed memory, which can lead to arbitrary code execution or manipulation of the process state. The weakness corresponds to CWE‑416, a classic memory safety issue that can compromise both confidentiality and integrity if executed successfully.

Affected releases include all Mozilla Firefox versions older than 159, and Firefox ESR 115.44 and ESR 153.6 before the disclosed patch. Any user running those versions is potentially vulnerable; no exact earlier version list is provided, but all releases preceding the listed fixed versions are considered at risk.

No CVSS score is available and the EPSS report is not supplied, but the vulnerability is listed as not part of the CISA KEV catalog. The flaw is likely exploitable via a malicious web page that contains crafted CSS, making the attack vector network‑based and client‑side. Without a patch, an attacker can trigger memory corruption during page rendering, potentially gaining arbitrary code execution on the client machine.