The vulnerability is a use‑after‑free flaw in the JavaScript Engine component of Mozilla Firefox. This type of memory corruption can allow an attacker to execute arbitrary code, potentially compromising confidentiality, integrity, and availability of the affected system. No further details about the specific attack path are provided, but the flaw’s nature suggests severe consequences if exploited.

Mozilla Firefox is affected. The vulnerability was fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10, implying that all earlier releases before those version numbers are vulnerable. The list of products is limited to the Mozilla Firefox browser; no other vendors or products are mentioned.

The CVSS score is not disclosed, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, indicating there is no public record of current exploitation for this issue. Nonetheless, use‑after‑free vulnerabilities in web browsers are high‑risk due to their ability to enable arbitrary code execution, especially when enabled scripts come from untrusted web content. The lack of publicly available exploit metrics does not reduce the potential impact; it merely reflects that the vulnerability is not yet observed in the wild.