Use‑after‑free vulnerabilities occur when a program continues to access memory after it has been freed, potentially enabling an attacker to read, modify, or execute code unexpectedly. In this case the fault lies in Firefox’s Disability Access APIs component, which is part of the accessibility stack. If successfully triggered, the flaw can lead to arbitrary code execution or a full compromise of the browser instance.

Mozilla Firefox versions released prior to version 159 and Mozilla Thunderbird versions prior to 159 are vulnerable. All users and devices running these older releases are potentially exposed until they apply the later patch.

Based on the description, it is inferred that the bug may be triggered by loading a malicious web page that interacts with the Disability Access API. No CVSS score and no EPSS data are publicly available, and the vulnerability is not listed in CISA’s KEV catalog. However, use‑after‑free bugs are known to permit remote code execution when triggered, and the affected interface is exposed to web content. If the bug can be reliably exploited from the network (for example, via a malicious web page), the risk to confidentiality, integrity, and availability is high. Because no exploit data is published, the exact likelihood of exploitation is uncertain, but the potential impact warrants urgent attention.