This vulnerability is a use‑after‑free error in the JavaScript engine component of Mozilla Firefox and Thunderbird. The flaw causes the engine to access memory that has already been released, leading to undefined behavior. While the CVE text does not detail a specific attacker scenario, such memory corruption can enable arbitrary code execution, data corruption, or denial of service if an attacker supplies malicious script to the vulnerable application.

Mozilla Firefox and Mozilla Thunderbird for all releases below version 149 are affected. The issue exists in any build of these products before the 149 release, irrespective of operating system.

The CVSS score of 9.8 classifies this flaw as critical. No EPSS score is provided and the vulnerability is not listed in the CISA KEV catalog. Because the defect resides in the JavaScript engine, the likely attack vector is a malicious web page or email attachment that runs code in the user's context, allowing remote exploitation. An attacker who delivers crafted JavaScript can potentially achieve arbitrary code execution or destabilize the application. Updating to Firefox 149 or later and Thunderbird 149 or later removes the flaw and eliminates the risk.