A use‑after‑free flaw in the Layout: Images, Video, and HTML Frames component can corrupt memory after a previously freed object is accessed. This memory corruption can lead to crashes, denial of service, or, if exploitable, arbitrary code execution at the level of the user’s browser process. The vulnerability is specifically tied to the handling of image, video, or HTML frame content loaded into Firefox.

Mozilla Firefox browsers affected by this flaw are versions prior to 159, as the patch was applied in Firefox 159. Any deployment running 158 or earlier is vulnerable.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the nature of a use‑after‑free in a widely used browser component carries a high potential for exploitation, especially via malicious web content. Attackers could deliver crafted image, video, or frame data to a victim browser to trigger the fault and achieve code execution. Without a CVSS score the exact severity is unspecified, but based on the weakness and the affected component, the risk is considered high for exposed users. The likely vector is a malicious or compromised website served over HTTP or HTTPS that contains crafted media or frame data.