Use‑after‑free in the DOM: Core & HTML component. The vulnerability indicates that the browser may access memory that has already been freed, potentially leading to undefined behavior. The description does not specify the exact consequences or exploitation details, so any further effects are inferred from the general nature of use‑after‑free flaws.

Mozilla Firefox users operating on versions earlier than 159 and Mozilla Thunderbird users operating on versions earlier than 159 are affected.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the CVSS score is not provided in the data, the exact severity cannot be quantified here; however, use‑after‑free conditions in a web rendering engine are typically considered high‑risk. The likely attack vector is the delivery of malicious web content—through a compromised site, a phishing page, or a locally opened file—that triggers the vulnerable code path in the browser. If an attacker can successfully exploit the use‑after‑free, they may gain arbitrary code execution in the context of the user’s profile.