The vulnerability involves a use‑after‑free condition within Firefox’s JavaScript garbage collector. When triggered, the garbage collector may access memory that has already been freed, potentially corrupting data or causing the application to crash. The flaw could be exploited by a malicious web page that constructs specially crafted JavaScript objects, leading to denial of service or, depending on conditions, arbitrary code execution.

Mozilla Firefox versions earlier than 159 are affected. The issue is within the JavaScript engine component and applies to all platforms that run these editions of the browser.

The CVSS score is not provided, and EPSS data is unavailable, so the precise severity level cannot be quantified from the supplied information. The vulnerability is not listed in CISA’s KEV catalog. Because the defect resides in the JavaScript engine, the most likely attack vector is a malicious web page delivered over HTTP or HTTPS, but no additional exploitation details are available.