Use‑after‑free in the JavaScript engine component allows an attacker to access memory that has already been freed. The vulnerability is fixed in Firefox 149 and Thunderbird 149. Based on the high CVSS score and the nature of use‑after‑free, it is inferred that an attacker could manipulate memory to achieve arbitrary code execution, compromising confidentiality, integrity, and availability of the affected system.

Mozilla Firefox and Mozilla Thunderbird are affected on any version older than 149 because the flaw resides in their JavaScript engine component. Both products have been patched in release 149, which includes proper memory deallocation and safety checks.

The CVSS score of 9.8 indicates critical severity, yet the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is remote, delivered through malicious web pages or email attachments that execute JavaScript within the browser or mail client. Exploitation requires the victim to open or run the crafted content, and the target must be running a pre‑149 version of the affected product.