This flaw is a use‑after‑free condition in the JavaScript engine that can let an attacker run arbitrary code inside the browser, potentially granting full control over the victim’s machine. The vulnerability compromises confidentiality, integrity, and availability by allowing the execution of malicious payloads. While the description does not specify an attack vector, it is inferred that the flaw requires the delivery of harmful JavaScript, such as through a compromised web page or a malicious email attachment, to activate the exploit.

Mozilla Firefox and Thunderbird are affected, specifically any release prior to Firefox 149 or Firefox ESR 140.9 for the browser, and any release prior to Thunderbird 149 or Thunderbird ESR 140.9 for the mail client.

The CVSS score of 9.8 marks it as critical, yet the EPSS score is below 1% indicating a low likelihood of widespread exploitation. The vulnerability is not in the CISA KEV catalog. Exploitation presumably requires delivery of malicious JavaScript to the user’s machine, so the attack vector is inferred as remote code execution via compromised web content or malicious email attachments. Successful exploitation depends on a vulnerable version of the JavaScript engine and user interaction that causes the code to run.