Use-after-free in the Widget Cocoa component allows memory corruption that can lead to execution of arbitrary code. The flaw arises when the component frees a memory object while a pointer to it is still in use, a pattern captured by CWE-416 and CWE-825. An attacker could exploit the vulnerability to crash the application or execute malicious code in the user’s address space, jeopardizing confidentiality, integrity, or availability of the affected system.

Mozilla Firefox and Thunderbird versions deployed before the 149 (standard) or ESR 140.9 releases are vulnerable. Any installation remaining on an older build of either browser has the flaw and should be updated.

The CVSS base score of 9.8 marks this issue as critical, yet the EPSS is under 1%, indicating a low current exploitation probability, and it is not listed in the CISA KEV catalog. The vector is client‑side: a malicious webpage or email that triggers the Widget Cocoa component can invoke the use‑after‑free, giving the attacker control over the application process. No special conditions are required beyond running the affected software, making exploitation straightforward once the path is known.