Uninitialized memory in the Audio/Video: Web Codecs component can expose data that has not been fully cleared, allowing a malicious actor to read previously processed contents. The flaw occurs when the API reads memory that was not initialized, producing a classic uninitialized read issue (CWE‑457) and a mismanaged reserved memory concern (CWE‑824). When media input triggers the Web Codecs API, the attacker may retrieve sensitive data or cause a crash. The likely attack vector is a crafted Web page or media file that leverages the Web Codecs API to access the vulnerable memory. The impact is primarily the inadvertent disclosure of data that could be used for data‑exfiltration or further exploitation.

Mozilla Firefox versions older than 150 and Firefox ESR 140.10, as well as Mozilla Thunderbird versions older than 150 and Thunderbird ESR 140.10, are affected. All later releases contain the fix. Users who process media through the Web Codecs API are the points of entry.

The CVSS score of 9.8 signals severe potential damage, yet the EPSS score is unavailable and the vulnerability is not in the CISA KEV catalogue, indicating that known exploitation is scarce. The likely attack vector is malicious media or a crafted Web page exploiting the Web Codecs API; the risk of immediate compromise is low to moderate. Successful exploitation would lead to information disclosure or a denial‑of‑service through a crash.