A use‑after‑free flaw was discovered in the DOM Core and HTML component that can corrupt memory and potentially allow an attacker to execute arbitrary code. The weakness is classified as CWE‑416, indicating that freed memory was accessed again. The vendor has fixed the issue in Firefox 148 and Thunderbird 148, meaning earlier versions are exposed to the risk of code execution if an attacker can supply malicious content such as a crafted web page or email.

The affected products are Mozilla Firefox and Mozilla Thunderbird. Versions older than 148 of either browser contain the vulnerable code paths. The vulnerability applies to all platforms where the browsers run, as the fix is in the cross‑platform core code.

The CVSS score of 8.8 classifies the issue as high severity. The EPSS at the time of assessment is below 1 %, indicating a low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely trigger the flaw by influencing a user to load malicious content or by exploiting a malicious email attachment so that the Unicode or HTML rendering code accesses freed memory. If successful, the attacker could obtain arbitrary code execution with the permissions of the user running the browser.