Use–after–free vulnerabilities arise when an application accesses memory after it has been freed. In this instance the JavaScript garbage collector in Mozilla products can operate on deallocated objects, allowing an attacker to corrupt memory or execute arbitrary code at a chosen address. This flaw can lead to remote code execution, denial of service, or host compromise, depending on how the attacker injects malicious JavaScript.

The vulnerability applies to Mozilla Firefox and Mozilla Thunderbird. Both products have incorporated the fix in release 148, so versions prior to 148 are affected while newer releases are not listed as vulnerable.

The CVSS score of 8.8 categorizes the issue as high severity, and the EPSS score of less than 1% suggests that exploit attempts are currently infrequent but feasible. The vulnerability is not present in the CISA Known Exploited Vulnerabilities list, indicating no known mass‑scale exploitation. Based on the description, it is inferred that attackers would most likely leverage malicious web pages or crafted email attachments that deliver JavaScript to trigger the use‑after‑free through the applications’ normal execution paths.