The vulnerability is a use‑after‑free condition in the DOM animation component of Firefox. When a malicious web page triggers certain animation operations, the browser may free memory that is still in use, allowing an attacker to craft input that redirects execution to arbitrary code or causes a crash. This type of failure can enable remote code execution or denial of service on a user’s machine if the user visits a crafted site. The defect was fixed in Firefox 159.

Mozilla Firefox is affected. All releases prior to version 159 contain the flaw. Desktop and mobile browsers that ship with those versions are potentially vulnerable. The issue is specific to the animation subsystem of the DOM. Upgrading to Firefox 159 or newer removes the vulnerability.

The exploit probability metric (EPSS) is not provided in the report, and the vulnerability has not yet been listed in the CISA KEV catalog. However, use‑after‑free bugs can be severe, and the lack of a public CVSS score makes precise quantification difficult. Given the nature of the bug, an attacker who can supply crafted content to a user’s browser could achieve arbitrary code execution or crash the browser. The vulnerability therefore carries a significant risk. Official remediation is to upgrade; no workaround is listed.