The vulnerability is a use‑after‑free error within the DOM Window and Location components of Mozilla products, potentially allowing an attacker to corrupt memory and execute arbitrary code. The flaw can be triggered when a script or web page interacts with a freed object, leading to undefined behavior that an attacker could manipulate for malicious purposes. The high CVSS score of 8.8 indicates that, if exploited, the attacker could gain full control over the affected application and any data the user has permission to access.

Mozilla Firefox versions older than 148 and ESR builds 115.33 or 140.8, as well as Mozilla Thunderbird versions older than 148 and ESR builds 140.8, are affected. The resolution was implemented in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

The CVSS score of 8.8 reflects high severity, while the EPSS score of less than 1% indicates a low likelihood of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is through malicious web content or a compromised email that renders a page using the vulnerable browser components. Because the vulnerability involves memory corruption, exploitation would require delivering crafted content to the victim’s browser or email client. No public exploit is documented in the provided references, and the risk remains theoretical until an exploit is seen in the wild.