This vulnerability is a use‑after‑free flaw in Firefox’s Layout: Scrolling and Overflow component. The flaw can corrupt memory when the component attempts to access a deallocated object, potentially allowing an attacker to execute arbitrary code or crash the browser. The weakness, identified as CWE‑416, indicates that improper handling of freed memory can lead to data integrity and confidentiality losses if an attacker can control the content that causes the overflow. The description does not explicitly mention successful exploitation, but typical use‑after‑free bugs of this type can lead to remote code execution in a privileged browser process.

Mozilla Firefox versions earlier than 147.0.2 are vulnerable. The patch was applied in Firefox 147.0.2, so any build prior to that is at risk. The issue affects all platforms supported by Firefox where the component is enabled.

The CVSS score of 8.8 indicates a high severity. However, the EPSS score is below 1%, suggesting that the likelihood of current exploitation is low and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to deliver or manipulate content in a context that causes the scrolling and overflow layout logic to reuse freed memory – most likely through a crafted web page or plugin. No publicly disclosed exploits are known, and the vulnerability appears to be in the early stages of exploitation potential.