The flaw occurs in the JavaScript WebAssembly handler where an object is freed too early while still referenced, creating a use‑after‑free condition. This weakness (CWE‑416) allows memory corruption if an attacker supplies crafted WebAssembly code that can be executed in the context of the JavaScript engine. The description does not detail a confirmed exploit, but such a condition can potentially lead to arbitrary code execution or denial of service within the affected application.

The vulnerability touches Mozilla’s Firefox and Thunderbird browsers. Versions prior to 148 are susceptible; the issue was patched in Firefox 148 and Thunderbird 148. The affected releases are those listed by the CPE identifiers or by the vendor product names above.

The CVSS score of 5.4 indicates moderate severity. EPSS is under 1 %, implying that market exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to deliver malicious WebAssembly payload to the victim’s browser, which typically means a compromised site or social engineering. Given the low EPSS, the actual risk for most users is low, but the existence of a use‑after‑free flaw warrants patching.