A use‑after‑free bug in the DOM core and HTML rendering components of Mozilla Firefox can corrupt memory used by the browser process. If an attacker manages to trigger the freed memory region, they could execute arbitrary code or crash the browser, compromising the system that owns the process. The weakness is a classic use‑after‑free flaw, identified as CWE‑416.

All Firefox releases prior to 154, including all Firefox ESR releases older than 140.14 and 153.1, are affected. Users running any of these versions should be aware that they are vulnerable until they update to a fixed build.

The CVE does not list an EPSS score or a KEV status, indicating that no publicly known exploit is tracked in those databases. However, the high confidence that the flaw can lead to memory corruption means that the risk of exploitation is significant, especially when a malicious webpage is rendered. The likely attack vector is via malicious or compromised web content that the user could encounter during normal browsing. Given the absence of mitigating controls in the affected releases, the overall risk remains high. A security assessment should consider that any user who visits untrusted sites could be exposed to this vulnerability.