This vulnerability is a use‑after‑free flaw in the DOM: Core & HTML component as identified by CWE‑416. The description implies it may corrupt memory or overwrite data structures when triggered, which could potentially let an attacker execute arbitrary code or crash the application. Based on the description, it is inferred that the likely attack vector involves malicious web content or local scripts that interact with the vulnerable component. The impact includes loss of confidentiality, integrity, and availability for affected users.

All Mozilla Firefox and Thunderbird releases before version 148 are affected. The issue is fixed starting with Firefox 148 and Thunderbird 148. Users on older versions are at risk if they browse the internet or receive email from untrusted sources.

The CVSS score of 8.8 indicates a high severity rating. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation could be possible through crafted web pages or local applications that trigger the use‑after‑free, potentially leading to code execution or denial of service. Security teams should treat this as a high‑priority issue for affected installations.