A use‑after‑free flaw in the JavaScript engine can allow an attacker to execute arbitrary code while a vulnerable program is running. The vulnerability in the JavaScript object model can be triggered by malformed or malicious script that releases a memory object before it is fully cleaned up, leading to a crash or arbitrary code execution. The flaw falls under CWE‑416, which indicates that the program can access memory after it has been freed.

Mozilla Firefox and Thunderbird, including the standard, Extended Support Release (ESR) branches. The security patches are delivered in Firefox v148, ESR 115.33 and ESR 140.8, and in Thunderbird v148 and ESR 140.8; any older versions of these browsers are potentially affected.

The CVSS base score is 9.8, denoting critical severity, but the EPSS score is under 1 %, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack path involves delivering malicious JavaScript through web content or email, which the affected browser will execute, giving the attacker foothold in the user’s environment. The lack of a public exploit makes the threat largely theoretical but the severity warrants immediate action.