A use‑after‑free flaw in the JavaScript engine’s JIT component allows an attacker to manipulate the memory management of the engine. Exploiting this defect can lead to arbitrary code execution, permitting complete compromise of confidentiality, integrity, and availability of the affected browser or mail client. The weakness is classified as CWE‑416, a typical memory corruption vulnerability where a reference is used after the target has been freed.

Mozilla’s Firefox and Thunderbird browsers are impacted when running versions prior to 148 for the standard release and prior to ESR 140.8 for the extended‑support line. Specifically, any installation of Firefox 147 or earlier, Firefox ESR 140.7 or earlier, Thunderbird 147 or earlier, or Thunderbird ESR 140.7 or earlier is vulnerable.

The CVSS v3.1 severity is 9.8, indicating a critical risk. The EPSS indicates a very low probability of exploitation in the short term (< 1 %) and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog, suggesting no active exploitation campaigns are publicly documented. However, the attack path is likely through malicious web content or compromised email attachments that trigger the JavaScript engine, and attackers could gain control of the user’s system remotely. The combination of high severity and the remote nature of the vectors underlines the need for prompt mitigation.