A use‑after‑free bug was identified in Firefox’s WebRTC component. When a client processes malformed WebRTC packets, the flaw can corrupt memory and potentially allow an attacker to execute arbitrary code or crash the browser. The official description does not disclose specific exploitation techniques, but the typical attack vector would involve a malicious WebRTC session, either initiated from a compromised web page or injected over the network.

Mozilla Firefox installations running any version before the security fixes delivered in Firefox 150 and the ESR release 140.10 remain vulnerable; this includes all earlier consumer releases and older ESR branches such as 140.9 and prior.

The lack of published CVSS or EPSS scores does not diminish the severity of a memory‑corruption vulnerability; the potential for remote code execution is substantial. No CISA KEV listing is reported, but the absence of publicly available exploits does not reduce the risk. Attackers would need to trigger a WebRTC session with crafted data to exploit the flaw, a scenario that could arise from malicious web content or compromised network traffic.