The vulnerability is a use‑after‑free flaw within Mozilla’s DOM core and HTML rendering engine, classified as CWE‑416, that can lead to arbitrary code execution if an attacker manages to trigger the freed memory region. The flaw also falls under CWE‑825, reflecting the risk of critical resource leaks that could magnify exploitation chances. An attacker who succeeds in invoking the vulnerability could take control of the browser process, compromising the confidentiality, integrity, and availability of the system.

All Mozilla Firefox releases prior to version 154, all Firefox ESR releases older than 140.14 and 153.1, all Thunderbird releases prior to version 154, and all Thunderbird ESR releases older than 140.14 and 153.1 are impacted. Users running any of these builds remain vulnerable until they move to a patched version.

With a CVSS score of 9.8 the flaw is critical, but its EPSS score is very low (<1%) and it is not listed in the CISA KEV catalog, indicating no publicly known exploits. The likely attack vector is rendering malicious or compromised web content, as the flaw is triggered by the browser’s DOM parsing logic; this is inferred from the description that the bug lies in the core HTML component. Because no defensive controls exist in the affected releases, any user visiting untrusted sites poses a high risk, especially when the browser lacks the necessary memory‑safety guards.