A race condition combined with a use‑after‑free bug in the WebRender graphics component can lead to memory corruption when rendering web pages or email content. If an attacker can trigger the race with crafted input, the corrupted memory may cause crashes or unexpected behavior in the rendering process.

Mozilla Firefox versions earlier than 149, Firefox ESR versions earlier than 115.34 and earlier than 140.9, and Mozilla Thunderbird versions earlier than 149 and Thunderbird ESR earlier than 140.9 are affected.

The vulnerability scores a CVSS of 7.5, indicating a high severity. EPSS below 1% suggests few active exploits at present, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote; an adversary could deliver malicious web content or an email that triggers the race during rendering, requiring the victim to open or view the crafted content. Successful exploitation would result in memory corruption that could destabilize the application or potentially lead to further compromise if additional vulnerabilities are present.