A use‑after‑free bug in the WebRTC signaling component allows an attacker to corrupt the browser’s memory and elevate privileges. The flaw falls under disclosure CWE‑416 and can enable the attacker to execute arbitrary code within the context of the user, potentially allowing full control over the compromised system.

Mozilla Firefox installations, specifically any version released before the introduction of the fix in Firefox 159. The vulnerability affects all operating systems where Firefox is installed and relies on the WebRTC signaling mechanism to communicate with media peers.

The exploit probability is not quantified due to the absence of an EPSS score, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the capability to gain elevated rights suggests a high severity. The likely attack vector is through malicious WebRTC signaling traffic initiated by a hostile website or local adversary. Without the EPSS data, defenders should assume a non‑negligible likelihood of exploitation until verified otherwise.