A use‑after‑free flaw in the JavaScript engine allows memory corruption that can lead to arbitrary code execution when a user loads a crafted web page or email. The vulnerability is classified as high severity with a score of 8.8 and is identified as CWE-416, indicating a classic use‑after‑free weakness that compromises integrity and confidentiality of the affected system.

Mozilla Firefox versions prior to 148 and the ESR 140.8 line, as well as Mozilla Thunderbird prior to 148 and the ESR 140.8 line are susceptible. Users of these browsers should verify they are running the patched releases to eliminate the risk.

The exploit probability is very low, and the vulnerability is not listed in the known exploited vulnerabilities catalog, suggesting no widely deployed exploits. Nevertheless, the high score indicates that exploitation would result in full system compromise. The likely attack vector is a remote attacker delivering malicious JavaScript to the victim’s browser or email client, making mitigation through patching essential.