The reported vulnerability is a use‑after‑free flaw in Mozilla’s DOM core and HTML processing components in both Firefox and Thunderbird. Freed memory can be accessed after its release, potentially causing memory corruption that may lead to arbitrary code execution or application crashes. This flaw threatens user privacy and system integrity.

Mozilla Firefox and Thunderbird are the affected vendors. The bug affects all releases prior to the patched release (version 159). No specific sub‑version list is provided, but users running any older release of either product should consider themselves vulnerable.

The CVSS score is not available, and EPSS data is missing, so the exact exploitation probability cannot be quantified from the advisory. However, a use‑after‑free in the core rendering engine indicates a high‑risk flaw that can be triggered by crafted web content or browser extensions. The vulnerability is not listed in CISA’s KEV catalog, suggesting no public exploit has been observed at the time of the advisory. Nonetheless, the impact severity and the nature of the flaw warrant prompt remediation.