This vulnerability is a use‑after‑free bug in the Graphics: WebRender rendering engine. When triggered, an attacker can escape the browser sandbox to execute code with the same privileges as the user. The flaw occurs when a dead object is accessed after it has been freed, allowing arbitrary memory manipulation that can subvert sandbox limits. An attacker could use a malicious web page or email that is rendered by the affected browser to trigger this behavior.

Mozilla Firefox and Mozilla Thunderbird are impacted. Versions prior to 159 of each product contain the flaw. The security advisory indicates the issue was addressed in Firefox 159 and Thunderbird 159. No more specific sub‑version details are documented.

The CVSS score is not provided in the CVE data, and the EPSS metric is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector would be a malicious web page or other untrusted content that is processed by the WebRender component. Exploitation requires that the renderer handles such untrusted input, after which the use‑after‑free can lead to arbitrary code execution outside the sandbox.