Use‑after‑free in the CSS parsing and computation component can allow an attacker to trigger a fault that may lead to arbitrary code execution or a crash. The vulnerability stems from improper memory handling during CSS parsing, which falls under CWE‑416 and CWE‑825. Successful exploitation could compromise confidentiality, integrity, and availability of the affected user, potentially permitting full system compromise if the code is executed in a privileged context.

Mozilla products are affected, including Firefox and Thunderbird. All versions prior to the fixes are vulnerable. The issue was addressed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users running older builds should verify their version and update accordingly.

With a CVSS base score of 9.8 and an EPSS below 1%, the vulnerability is considered critical, though exploitation is predicted to be rare at present. It is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread active exploits. However, the likely attack vector is through crafted web content or mail messages containing malicious CSS, meaning any user who visits a compromised site or opens a malicious email could be impacted. Admins should therefore treat this as a high‑priority patching issue.