A use‑after‑free flaw exists in the Just‑In‑Time (JIT) component of Mozilla’s JavaScript engine. The defect can be triggered by executing crafted JavaScript, causing memory corruption that may allow an attacker to gain arbitrary code execution privileges. This vulnerability directly undermines the integrity of the browser or email client’s execution environment and can compromise confidentiality if exploited.

Mozilla Firefox browsers and Thunderbird email clients prior to version 159 are vulnerable. The flaw is confined to the JIT part of the JavaScript engine; newer releases incorporate a patch that prevents the use‑after‑free condition.

No EPSS score is reported and the flaw is not listed in the CISA KEV catalog, so formal exploitation likelihood metrics are unavailable. Based on the description it is inferred that exploitation would entail delivering malicious JavaScript in a trusted context, such as a compromised web page or a user‑initiated action, and then triggering the use‑after‑free condition. Successful exploitation would grant an attacker code execution privileges equivalent to the user's browser or email client session.