Mozilla has identified a use‑after‑free condition in the JavaScript garbage collector that could allow attackers to corrupt memory after a freed object is accessed. Although the official advisory does not detail the exact impact, use‑after‑free bugs in a browser’s JavaScript engine typically enable arbitrary code execution. The problem was addressed in Firefox 154 and the corresponding ESR branch in version 153.1.

Affected releases are Mozilla Firefox 154 and the ESR line Firefox 153.1. No other version ranges are listed in the advisory.

The CVSS score is not provided and the EPSS value is unavailable. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to deliver malicious JavaScript – for example via a compromised or malicious website – to trigger the use‑after‑free. Considering typical browser exploitation trends, the risk of exploitation is significant, especially if a user visits an untrusted site or executes injected code.