The vulnerability is a use‑after‑free in the Disability Access APIs component of Mozilla Firefox and Thunderbird. This defect allows an attacker to escape the sandbox, enabling execution of code with the privileges of the user profile. The potential impact includes compromise of confidentiality, integrity, and availability of user data and the system.

Affected systems are Mozilla Firefox users running versions prior to 159 and Mozilla Thunderbird users running versions prior to 159, regardless of operating system or platform. The defect was fixed in those releases; any installation of version 158 or earlier remains vulnerable.

No CVSS or EPSS metrics are provided in the advisory, and the vulnerability is not listed in CISA KEV. Because of the lack of publicly available exploitation evidence, the exact probability of exploitation cannot be quantified. Nevertheless, a sandbox escape is a high‑severity issue that warrants remediation without delay.