A use‑after‑free flaw was discovered in the WebAssembly component of the JavaScript engine. The bug permits attackers to corrupt memory, potentially leading to arbitrary code execution within the browser context. This vulnerability compromises confidentiality, integrity, and availability by enabling an attacker to run malicious code on the victim’s system.

Mozilla Firefox and Mozilla Thunderbird are affected. Both products contain the WebAssembly component in their JavaScript engines. The issue was addressed in version 150 of each product, meaning all earlier releases are vulnerable.

The EPSS score is not available and the vulnerability is not listed in the KEV catalog, so no verified exploits are known at present. The path to exploitation would likely involve delivering malicious content to the browser, such as a crafted WebAssembly script, and then triggering the use‑after‑free condition. The CVSS score of 7.5 indicates high severity based on the ability to execute arbitrary code, but lack of an EPSS score means the likelihood of real‑world use is uncertain.