A use‑after‑free flaw in Firefox and Thunderbird’s CSS Parsing and Computation component can corrupt memory and allow an attacker to execute code in the context of the user or system. The vulnerability is scored at 9.8 on the CVSS scale, reflecting the potential for complete compromise. While the description does not specify a particular entry point, the likely attack vector is rendering malicious web content or email that contains specially crafted CSS. This inference is based on the nature of CSS parsing in web browsers and email clients.

The flaw affects Mozilla Firefox versions older than 149, as well as all ESR builds below 115.34 and below 140.9. Thunderbird versions older than 149 and ESR builds below 140.9 are also vulnerable. No specific patch version has been listed in the data, indicating that the user must upgrade to a version that is not listed as affected.

The vulnerability carries a CVSS score of 9.8 and an EPSS score of less than 1%, and it is not featured in the CISA KEV list. This combination indicates a high-severity flaw that is unlikely to see widespread exploitation currently, but the potential for remote code execution is significant. Successful exploitation would require an attacker to supply malformed CSS that triggers the use‑after‑free condition, most plausibly through a malicious web page or email attachment. The impact could be total system compromise if the flaw is executed with sufficient privileges.