Use‑after‑free in the WebRTC component allows memory corruption when a client processes malformed WebRTC packets, and the flaw is categorized as CWE‑416 and CWE‑825. Based on the nature of the memory corruption, it is inferred that an attacker could potentially cause arbitrary code execution or crash the browser. The vulnerability was addressed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox installations running any version before the security fixes delivered in Firefox 150 and the ESR release 140.10 remain vulnerable; this includes all earlier consumer releases and older ESR branches such as 140.9 and prior. Mozilla Thunderbird installations running any version before the security fixes delivered in Thunderbird 150 and the ESR release 140.10 also remain vulnerable.

The vulnerability carries a CVSS score of 7.5. EPSS information is not available, and the issue is not listed in CISA KEV. Based on the description, it is inferred that attackers would need to trigger a WebRTC session with crafted data, a scenario that could arise from malicious web content or compromised network traffic. Although no publicly available exploits are documented, the memory‑corruption nature of the flaw could potentially enable remote code execution, but this outcome is not confirmed.