The vulnerability is a use‑after‑free error in the XPCOM component of Firefox and Thunderbird that allows an attacker to escape the browser sandbox. By exploiting the freed memory pointer, an adversary can execute arbitrary code with higher privileges than the browser process normally has, potentially compromising the host system. The weakness aligns with the use‑after‑free category.

Mozilla Firefox and Thunderbird versions released prior to 159 are affected. The fixed versions 159 for each include the patch for the XPCOM use‑after‑free flaw.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. While the exact likelihood of exploitation is unknown, the high impact of sandbox escape combined with the ease of triggering a use‑after‑free condition suggests that this flaw could be targeted if an attacker can influence XPCOM activity. The CVSS score is not provided in the data, but the nature of the flaw generally correlates with a high severity rating.